DKIM (DomainKeys Identified Mail) lets your gateway cryptographically sign every outgoing message so that receiving servers can verify the message really comes from your domain and was not altered in transit. Artica Milter signs outbound messages and also verifies inbound DKIM signatures, rewriting the Authentication-Results header accordingly.
¶ Why you should sign your mail with DKIM ?
- Deliverability:
major providers (Gmail, Microsoft 365, Yahoo) increasingly require a valid DKIM signature. Signed mail is far less likely to land in the spam folder or be rejected. - Anti-spoofing:
A DKIM signature proves the message was emitted by a server holding your private key. Combined with SPF, it is the foundation of a DMARC policy. - Integrity:
Any modification of the signed headers or body after signing invalidates the signature, so tampering is detectable by the receiver. - Zero key management effort:
Artica generates the RSA key pair automatically and displays the exact DNS record to publish. - Multi-domain ready:
Create one DKIM rule per mail domain, each with its own selector and key.
¶ Use cases
- Corporate outbound relay signing all mail for
example.combefore it leaves for the Internet. - A hosting provider signing several customer domains on the same gateway (one rule per domain).
- Preparing a DMARC deployment: DKIM alignment is required to reach
p=quarantineorp=rejectsafely. - Key rotation: create a new rule with a new selector (e.g.
mail2026), publish the new DNS record, then remove the old rule.
¶ Create the DKIM rule
Open MTA Mail system » Access Control Lists, click New Rule and select DKIM:
The rule appears in the rules list with a DKIM badge:
Like any Artica Milter rule, the DKIM rule needs at least one object to define which messages are in scope — typically your sender domain. See Available objects.
¶ Configure the signing options
Open the rule and select the Options tab:
| Option | Meaning |
|---|---|
| Domain | The mail domain to sign (the d= tag of the signature). Only messages whose author domain matches are signed. |
| Selector | The DNS selector (the s= tag). The public key is published at <selector>._domainkey.<domain>. |
| Canonicalization | How headers/body are normalized before signing. relaxed/relaxed is the recommended, most tolerant setting. |
| DNS Configuration | Once the key exists, this area shows the exact TXT record to publish in your DNS zone. |
Click Apply. If no private key exists yet for this domain/selector, Artica creates it automatically and stores it under /etc/dkimPKs/<domain>/<selector>.pem.
¶ Publish the DNS record
Copy the TXT record displayed in the DNS Configuration area into your DNS zone:
mail._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."
You can verify the record with:
dig +short TXT mail._domainkey.example.com
Once the record is published, outgoing messages carry a DKIM-Signature: header and receivers report dkim=pass in their Authentication-Results.
¶ Inbound verification
For inbound messages, Artica Milter verifies existing DKIM signatures, strips forged Authentication-Results headers claiming your identity, and prepends a fresh Authentication-Results header with the real verification outcome. Downstream filters and mail clients can rely on it.
¶ Related features
- ARC sealing — preserve authentication results across forwarding.
- Greylisting — authenticated senders bypass greylisting.
- Monitoring & REST API — generate keys and reload rules from the command line.