SOLVED

Dkim with multiple domains in Office 365

%3CLINGO-SUB%20id%3D%22lingo-sub-291608%22%20slang%3D%22en-US%22%3EDkim%20with%20multiple%20domains%20in%20Office%20365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-291608%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%C2%B4m%20about%20to%20implement%20DKIM%20and%20DMARC%20in%20to%20an%20orginzation%20with%20multiple%20domains%20(7).%3C%2FP%3E%3CP%3EEvery%20user%20uses%20the%20same%20domain%20name%20but%20it%C2%B4s%20some%20shared%20mailboxes%20which%20can%20have%20different%20domain%20names.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAs%20i%20read%20some%20posts%20where%20some%20has%20experienced%20issues%20with%20DKIM%20and%20shared%20mailboxes%20in%20Office%20365%20I%20have%20not%20activated%20it%20on%20the%20domains%20yet.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EQuestions%3A%3C%2FP%3E%3CP%3E-%20Is%20it%20any%20issue%20to%20use%20shared%20mailboxes%20when%20you%20activate%20DKIM%3F%3C%2FP%3E%3CP%3E-%20Can%20I%20set%20up%20DKIM%20only%20for%20one%20domain%20or%20i%20need%20to%20set%20it%20up%20on%20every%20domain%20in%20the%20tenant%3F%20(If%20I%C2%B4m%20not%20are%20goin%20to%20use%20DKIM%20features%20on%20the%20other%20domains%3C%2FP%3E%3CP%3E-%20Is%20it%20anything%20else%20that%20can%20be%20tricky%20with%20DKIM%2FDmarc%20when%20you%C2%B4ve%20multiple%20domains%20or%20can%20i%20as%20user%40domain.com%20send%20mail%20from%20a%20shared%20mailbox%20named%3A%20shared%40domain3.com%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20populated%20the%20cname-record%20but%20not%20activated%20it%20yet%20since%20i%20need%20an%20answer%20on%20the%20questions%20above.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%2F%2FMartin%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-291608%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3E2016%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAdmin%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%20Online%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%20Server%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-294511%22%20slang%3D%22en-US%22%3ERe%3A%20RE%3A%20Dkim%20with%20multiple%20domains%20in%20Office%20365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-294511%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20alot!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-292123%22%20slang%3D%22en-US%22%3ERe%3A%20RE%3A%20Dkim%20with%20multiple%20domains%20in%20Office%20365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-292123%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Martin%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENo%20worries%2C%20glad%20I%20could%20help.%20If%20you%20did%20want%20to%20run%20a%20quick%20check%20you%20can%20run%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EGet-Mailbox%20%7CSelect%20DisplayName%2C%20GrantSendOnBehalfTo%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIt%20should%20give%20you%20an%20output%20like%20in%20the%20attached%20picture.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ETake%20care%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-292059%22%20slang%3D%22en-US%22%3ERe%3A%20RE%3A%20Dkim%20with%20multiple%20domains%20in%20Office%20365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-292059%22%20slang%3D%22en-US%22%3E%3CP%3EAs%20i%20know%2C%20they%20are%20not%20working%20with%20sendasbehalf%2C%20so%20it%20shouldn%C2%B4t%20be%20any%20issue%20then!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20the%20clarification!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-291621%22%20slang%3D%22en-US%22%3ERE%3A%20Dkim%20with%20multiple%20domains%20in%20Office%20365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-291621%22%20slang%3D%22en-US%22%3EYes%20I%20remember%20the%20issue%20-%20SendAs%20works%20but%20SendonBehalfOf%20failed%20as%20the%20DKIM%20generation%20was%20incorrectly%20set.%20I%20believe%20this%20was%20raised%20to%20Microsoft%20and%20resolved%20-%20but%20I%20haven't%20seen%20any%20further%20information%20on%20it%20since.%20Do%20you%20have%20SendonBehalfOf%20utilised%20a%20lot%20in%20your%20Org%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-291614%22%20slang%3D%22en-US%22%3ERe%3A%20Dkim%20with%20multiple%20domains%20in%20Office%20365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-291614%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20the%20answer.%3C%2FP%3E%3CP%3EOkej%2C%20so%20DKIM%20checks%20will%20be%20legit%20even%20if%20you%20send%20from%20a%20shared%20malbox%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAs%20i%20understood%2C%20sendas%20should%20work%2C%20sendonbehalf%20is%20worse%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-291612%22%20slang%3D%22en-US%22%3ERe%3A%20Dkim%20with%20multiple%20domains%20in%20Office%20365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-291612%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20there%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20can%20enable%20DKIM%20on%20select%20domains%20yes.%20You%20do%20not%20have%20to%20bulk%20enable%20all%20domains.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20aware%20of%20the%20initial%20dkim%20issue%20for%20shared%20mailboxes%20when%20the%20DKIM%20service%20was%20made%20available%20in%20Exchange%20Online.%20I%20believe%20this%20is%20now%20resolved%20however.%20To%20enable%20DKIM%20on%20a%20per%20domain%20basis%20simply%20select%20'enable'%20and%20ensure%20you%20setup%20the%20associated%20CNAME%20record.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMore%20information%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fuse-dkim-to-validate-outbound-email%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fuse-dkim-to-validate-outbound-email%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor

Hi,

 

I´m about to implement DKIM and DMARC in to an orginzation with multiple domains (7).

Every user uses the same domain name but it´s some shared mailboxes which can have different domain names.

 

As i read some posts where some has experienced issues with DKIM and shared mailboxes in Office 365 I have not activated it on the domains yet.

 

Questions:

- Is it any issue to use shared mailboxes when you activate DKIM?

- Can I set up DKIM only for one domain or i need to set it up on every domain in the tenant? (If I´m not are goin to use DKIM features on the other domains

- Is it anything else that can be tricky with DKIM/Dmarc when you´ve multiple domains or can i as user@domain.com send mail from a shared mailbox named: shared@domain3.com?

 

I have populated the cname-record but not activated it yet since i need an answer on the questions above.

 

//Martin

6 Replies

Hi there,

 

You can enable DKIM on select domains yes. You do not have to bulk enable all domains.

 

I am aware of the initial dkim issue for shared mailboxes when the DKIM service was made available in Exchange Online. I believe this is now resolved however. To enable DKIM on a per domain basis simply select 'enable' and ensure you setup the associated CNAME record.

 

More information: https://docs.microsoft.com/en-us/office365/securitycompliance/use-dkim-to-validate-outbound-email

Hi,

 

Thanks for the answer.

Okej, so DKIM checks will be legit even if you send from a shared malbox?

 

As i understood, sendas should work, sendonbehalf is worse?

Yes I remember the issue - SendAs works but SendonBehalfOf failed as the DKIM generation was incorrectly set. I believe this was raised to Microsoft and resolved - but I haven't seen any further information on it since. Do you have SendonBehalfOf utilised a lot in your Org?

As i know, they are not working with sendasbehalf, so it shouldn´t be any issue then!

 

Thanks for the clarification!

best response confirmed by Martin Front (Contributor)
Solution

Hi Martin,

 

No worries, glad I could help. If you did want to run a quick check you can run:

 

Get-Mailbox |Select DisplayName, GrantSendOnBehalfTo

 

It should give you an output like in the attached picture.

 

Take care,

 

 

Thanks alot!