DKIM signing and cloud mail service

[Greg.Howley]

We are migrating to a cloud vendor for email.  

Some of our internal systems still send mail to the internet.  We have not enabled dkim signing on the ironports, but our cloud vendor signs everything.  

How do I sync dkim between Ironports and our cloud vendor?   

[Philip D'Ath]

You don't have to dkim sign your email on your Ironports if you don't want to.

Also the keys do not have to be synchronised.  Your cloud provider can use one set of DKIM signing keys and your Ironports their own DKIM signing keys.  In fact, this is highly likely to be the way it would be done.

[Greg.Howley]

OK, follow up question.

We are trying to enforce DMARC.

I have DKIM signing enabled everywhere I can see on the Ironports.  DMARCIAN reports show that one of our domains still sends a number of unsigned emails to our cloud provider (via our Ironports).  How do I determine why these aren't being signed?

Hangon, trolling through the logs I found a bunch of stuff that says DomainKeys: cannot sign - no profile matches usrname@DOMAIN.com

My signing profile is for domain.com.  Is it case sensitive?

[dmccabej]

Hello,

The reason you're seeing this message is because the ESA is checking for both a DomainKeys /and/ a DKIM profile prior to signing the message. As long as you have DKIM setup successfully you should see this message along with a successful DKIM signing right after. If that is the case then you can ignore the DomainKeys log as it's non-impacting.

You should see something similar to the following : 

DKIM: signing with dkim-sign - matches user@domain.com

Thanks!

-Dennis M.

[Calibre Lee]

I am having issue of getting DKIM to work on Cisco ESA for outgoing email.

I get the “dkim permerror” below.

1. Scenario: DKIM Signing for Outgoing Mail

Email Setup:

MTA (Relay Host) -> ESA (Relay Server) -> Internet. MTA sits behind the ESA.

For Outgoing Email, does the MTA perform DKIM Signing or ESA or both? Can you please advise which method is the best practice.

May I please seek your assistance.

[Ken Stieers]

Generally, the last hop outbound should sign the mail.

Did the dkim dns entry get published to your dns servers?

[Calibre Lee]

Hi Ken,

My apologies for a delayed response.
Good advice, I will disable the DKIM signing on the "MTA (Relay Host)", the Originating Internal MTA.

I will double check.

I recall I published a dkim dns entry on the internal dns server for the "MTA (Relay Host)", and a different dkim entry on the external dns server (Internet facing), for the ESA (last hop outbound) dkim signing .

PLEAS NOTE: this topology is in a lab environment to simulate Internet Mail.

[Calibre Lee]

Hi Ken,

My dns server has the correct dkim record. Please refer to results below.

ESA tested successfully.

Receiving Mail Server responded correctly with dig.

However, dkim faile because 'no key found in DNS' , as shown below.

DKIM:'FAIL'

Can you please assist?

[Ken Stieers]

Using Mxtoolbox.com, I'm not finding your dkim record at all... 

[Calibre Lee]

Hi Ken,

I really appreciate for your prompt response.

My apologies, these are private domains exist in home lab environment.

RE: What's more important to me to implement TLS on Cisco ESA.

May I please make the following inquiries about on how to do it.

I know it's for email encryption but that's about it, but then...:

What is it used for?

How does it work?

Can TLS be implemented for both outgoing and incoming mails?

If only for outgoing email from me to the recipient, then does the receiving mail server require to have TLS implemented?

Regards

Lee

[Ken Stieers]

Hey Lee... 

So TLS between email servers is like putting certs/and https on web servers.  It works pretty much the same way.   The client (eg sending server) connects to the receiving server and the server sends its cert and they agree on the encryption and then send the data through the encrypted connection.  

The intent is to keep the emails from being easily sniffed/read by others.   It can be on both incoming out going mails.

You technically don't need a certificate on the ESA for outgoing mail to be encrypted, you configure that in the Mail Policy/Destination Controls.

For inbound mail, you put a certificate on your ESA, and in the various Mail Flow Policies you can set it much like you do with destination controls... (none/preferred/required) 

[Calibre Lee]

Hi Ken,

That's great. Thank you for your assistance.

Have a nice day.

[Calibre Lee]

Hi Ken,

Can you please confirm for me if Destination Controls is used for incoming mail or outgoing mail or both

[Ken Stieers]

It is used for all mail leaving the ESA...

So mail leaving your email server gets to the ESA and on its way to my server would be configured via destinations controls..

And inbound mail from my servers to your ESA can also be configured via the destination controls on how it gets delivered to your email servers.

[Calibre Lee]

Thank you very much for the explanation.

Have a nice weekend