Supporting DKIM records to multiple mail servers on a single domain will authenticate and secure an email since each mail server is uniquely labeled with a pair of DKIM keys. Using selectors in the DNS records, transactional._domainkey and marketing._domainkey, organizations may distinguish between the mail servers and keep just one domain. Individual mail servers sign emails using their own, private key, and recipient servers can prove the authenticity of the email by reading its sender using the corresponding, public key listed in DNS. This configuration guards against email spoofing, increases deliverability, and passes all security protocols including DMARC.
What is DKIM?
A cryptographic-based message authentication system called DomainKeys Identified Mail (DKIM) verifies messages by digitally signing the email message header. Signature proves that the contents of the email message have not been changed in transit and that the username authorizes the sender to use the emails on behalf of the domain.
The Need for DKIM Records in Email Security
The malicious use of email and email-based attacks such as phishing and email spoofing have increased. Necessitating the implementation of added security measures to the email security system of organizations. DKIM records can be used as a countermeasure to such attacks because:
- Authentication of senders: DKIM assists the recipient mail server to confirm that the email was sent by the purported domain.
- Preserving the integrity of email: The email’s content was not changed during transmission, as confirmed by the DKIM signature.
- Enhanced deliverability: Mail servers, which use DKIM protocols in their mailing systems are less prone to blocking their emails or labeling them as spam.
DKIM and Multiple Mail Servers
In a situation where a domain has multiple mail servers sending email (as in a single message service having one server used within the company. Another used for marketing, and another used for transactional mail), it becomes a little more complicated to manage DKIM records. All of the mail servers should use the same domain but each DKIM signature is unique in order to achieve adequate authentication. This is where DNS records are used.
Setting Up DKIM for Multiple Mail Servers
To make DKIM functional on a series of mail servers. Every server needs to have a series of DKIMkey pairs (public and private key). This is the way to control DKIM across multiple mail servers on one domain:
1. Create a unique DKIM Key Pair to Each Mail Server
DKIM requires DKIM key pair per mail server. This brings about the authentication of emails that sent over different servers though they may be using the same domain.
To create the keys DKIM:
- Private Key: The key stored at the mail server and signed outgoing emails signed using the key.
- Public Key: The key goes into DNS records of your domain where recipient servers can authenticate DKIM signature.
2. To Distinguish DKIM Records, Add a Selector
To prevent confusion with numerous mail servers, one has to employ a selection in the DKIM DNS records. A selector an additional named portion that concatenated to the name of a DKIM record to distinguish which keys associated with which servers.
As another example, suppose you have two mail servers: * one that sends transactional emails and * the other marketing emails you could map the following selectors:
transactional.domainkey.example.com
marketing.domainkey.example.com
All of these selectors will be referring to a distinct DKIM public key in your DNS configuration.
3. The DKIM DNS Records need to be generated
After generating DKIM keys on each of your mail servers. You will have to create matching DKIM records on your DNS. DKIM records are TXT files that contain the selector & the public key.
The transactional mail server has a DKIM record that looks as follows:
arduino copy Edit transactional.domainkey.example.com. IN TXT v=DKIM1; k=rsa; p=MIGfMA0GCSq...<public key>
And on marketing mail server:
arduino copy Edit marketing._domainkey.example.com. IN TXT v=DKIM1; k=rsa; p=MIIBIjANBgkqh...<public key
These records:
- These are transactional and marketing as the selectors.
- v=DKIM1 spells the version of DKIM.
- k=rsa is the type of key.
- The public key written after a p=.
You should ensure each record in your DNS to have the right selector to match the right mail server.
4. Install the Private Key in Your Mail Servers
On every mail server, DKIM needs to set up to use its own private DKIM key to sign email. This configuration is different with different email server applications. Following are typical server settings:
- Postfix: Opendkim package will allow the postfix to sign with DKIM many domains or selectors.
- Microsoft Exchange: Use the DKIM Exchange add-on that signs the outgoing messages with corresponding DKIM key.
- SendGrid, Mailgun, and Other Email Services: These services give the opportunity to configure DKIM in a user interface. The generated DKIM keys have to entered in their settings.
5. Check Your DKIM Setup
If you have configured DKIM records in your DNS and mail servers configured to sign emails using their personal keys then it the time to test the implementation. Online DKIM test checks like:
- DKIMCore: It checks that your DKIM set up properly configured.
- MXToolbox: This one can tell you what your DKIM DNS records look like, and can tell you whether selector and keys set properly.
You may also send a test email to an address that allows DKIM signature verification (the IMAP supported by most aggressive email providers). Examine the email messages to verify the DKIM signature and that it is valid.
6. Oversee DKIM Performance
Once DKIM configured, one should monitor how it works, addresses any problems that appear. Watch for:
Delivery issues of the email: In case the DKIM does not verify, the email rejected by the receiver server marked as spam.
Invalid signature: Email signature may fail to authenticate when the private key on the mail server is improper or when the DNS entries containing the public key of the keyring has erroneous information.
DKIM alignment: This will verify DMARC (Domain-based Message Authentication, Reporting & Compliance) checks by matching the domain in the DKIM signature to the domain of the sender address authenticated by the sender through the header field, From.
Advantages of DKIM Records for Multiple Mail Servers on One Domain
Centrally administering DKIM on many mail servers across a single domain has a variety of benefits:
- Email Authenticity: Authenticates that the email sent using a different server authenticated ensuring email spoofing is unlikely to happen.
- Better Deliverability: DKIM increases recipient mail servers’ trust, which reduces the likelihood that your emails flagged as spam.
- Easy to manage: Forgiving that each server has a dedicated selector to manage each mail server, DKIM keys are straightforward to manage and troubleshoot across multiple servers.
- Enforcement of DMARC: In the case of multiple mail servers, ensure that you encrypt them using DKIM in order to comply with DMARC policies and further resistant to spoofing and phishing.
Conclusion
Adding DKIM records to multiple mail servers within one domain is important to organisations who have mailers set up on more than one server to send mail. Businesses can boost the security of their mail and guarantee improved deliverability by creating unique DKIM key pair on each mail server and use selectors to identify them and make sure they have appropriate DNS records. To ensure a good and safe email environment it always recommended to test and monitor your DKIM setup.
Employing these steps, your domain will be safer against email-related threats and make sure your messages gain the recipients’ trust.
