DKIM for Exchange Hybrid Setup

FrenchCow

Hi everyone,

Over the last couple of days, I have installed a Mailcow server in an Exchange Hybrid setup following this page https://mailcow.github.io/mailcow-dockerized-docs/third_party-exchange_onprem/ and others on the Internet.

Some email accounts will be on O365. Others on Mailcow. O365 is the front server (receiving all inbounds emails) and relaying them, if applicable, to Mailcow. Outbound emails from Mailcow are ALL relayed by O365.

I am not sure about the right thing to do with the DKIM key.

When I initially installed mailcow, I added a public TXT entry (dkim._domainkey) to the domain DNS with the DKIM key provided by Mailcow.

But after the Exchange Hybrid is now setup (with Split Domain Routing) I wonder what I should do:
1) keep the initial TXT entry with the DKIM key provided by Mailcow as it is
2) delete the TXT entry with the DKIM key provided by Mailcow and add O365 DKIM keys (done by adding two additional CNAME entires according to that page https://docs.mailshake.com/article/222-dns-record-microsoft)
3) or keep 1) and add 2), meaning that there will be 3 entries for DKIM in the DNS (one from Mailcow and 2 from Microsoft)
4) something else

It would be great if you could advise me.

FrenchCow

I have investigated further, I am happy to report that I have solved the issue and would like to share it with the community as it might help other people. I also suggest to update the following page with the information https://mailcow.github.io/mailcow-dockerized-docs/third_party-exchange_onprem/

The answer is 2):

You need DKIM enabled for the system that is sending mail externally. If all your outbound mail goes out through 365, enable DKIM there and disable anything else. DKIM will be applied to your outbound emails, but not to your emails between Mailcow and Exchange.

Actions to be taken:

On your Mailcow: delete the DKIM key
On your Exchange/O365: Activate/Enable the DKIM key for your domain
On your DNS manager (in my case, it is my registrar): delete the TXT entry with the DKIM key provided by Mailcow, and add O365 DKIM keys (done by adding two additional CNAME records according to that page https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/use-dkim-to-validate-outbound-email?view=o365-worldwide#steps-you-need-to-do-to-manually-set-up-dkim)