Yes, it is working. I am running Dkim successfully in more than one enviroment. 

Thanks Diethmar!

So, SMG will provide me the Public key when I "enable" the feature?  ..and then just add a rule to sign outgoing email?

Yes, it is working. I am running Dkim successfully in more than one enviroment.

There is one situation where dkim is not working - if message body is empty. So give your test messages a body

Yes, you are right. This is the hardest part of your work. Your DNS server has to understand this entry. Now you will find out that DNS is not DNS .

I.e. One of my customer's dns was too old to accept the whole key. 

I can confirm that it works as well. And it is safe to test if you create your DMARC record with a policy p=none. With a DMARC record you can receive reports about how DKIM works and/or what you still have to do.

Sending a mail to gmail is a very good way to test your DKIM settings. Gmail shows useful information if you go for "show original".

Thanks, I already have DMARC running and have been getting reports for several days now (p=none)!

Curiously, after changing ISP's, previously "happy" customers (at least one major) started bouncing our email.  I've checked several aggregate reporting sites (inc mxtoolbox) and our IP is coming up clean on every blacklist so not sure why they claim our "IP Reputation" is "poor". Anyway, I set up DMARC (which we didn't need to communicate previously) and I just want to be ready to implement DKIM if DMARC doesn't make them "happy" again.  We have always used SPF so right now DMARC is only using our long standing SPF record (which references our allowable sender by "MX" - as always - and not a specific IP - and the DNS/mx record has obviously been updated as well)

So not sure why this one (US Gov) recipient was unhappy.  Maybe they just hadn't seen any traffic from our new IP before...

Thats good to know - thanks! 

Eventually, I'll likely turn on DKIM in any case, but I'm hoping our new IP address will "settle in" before I start changing things again...

I have recently experienced poor performance with a customer when sending emails to a company protected by Cisco spamfilter equipment. Cisco has the talosintelligence database (https://www.talosintelligence.com/). And it's own rules to block IP's. One of the rules is that the sending IP dns fqn has to be the same as the fqn in the smtp ssl certificate. And the RR record has to be aligned as well.

evanevery said:

So not sure why this one (US Gov) recipient was unhappy.  Maybe they just hadn't seen any traffic from our new IP before...

Edward, this is the problem with IP reputation. I have the same issue.

It's not that your IP address has a bad reputation, it just doesn't have a good reputation.

Micro Focus uses SMG. When SMG started using Bitdefender, all my SR email replies were blocked. They had to create an IP address exception for me. For that reason, I don't filter email based on IP reputation. It doesn't matter where you set the slider, some important email will get blocked.