DKIM (Domain Keys Identified Mail) is an email authentication method that adds an encrypted header (DKIM signature) to outgoing mail. Using a DKIM policy, admins can sign outbound mail with custom DKIM keys.
All domains associated with a DKIM policy will be signed by a standard Trellix DKIM key. For more information on Trellix DKIM keys, see "About DKIM Signing" in Message analysis policies.
Administrators can generate custom keys to sign outbound mail with in addition to the Trellix keys. When a custom key is created, the email will be signed with both signatures.
To use a custom DKIM signature, you must create the policy, generate the keys, update your DNS record, validate the keys, and then associate the policy to a domain.
To create a DKIM policy:
From the Email Cloud dashboard, select Configuration > Policies.
Click Create Policy.
Next to Traffic Type, select Outbound.
Select DKIM Policy.
Enter a policy name and description (optional).
Click Create.
The new policy page opens.
To generate a DKIM key:
Next to DKIM Configuration, select Manage.
Click Generate Keys.
Select your key length: 1024 or 2048 bits.
Click Submit.
Two keys are generated. The primary key is the key used to sign mail.
To update your DNS records:
Important
You must update your domain's DNS records before you validate the DKIM keys. Work with your domain hosting provider to create a new CNAME or TXT record in your DNS settings before proceeding.
Hostname creation is not supported for US Government users. The Copy Hostname option is disabled. Use the Copy Public Key option to create the required TXT record for your domain. Update the corresponding TXT record as necessary when regenerating your secondary selector public key.
You can manage DKIM keys through the portal by adding CNAME records in your DNS or you can manually manage records by adding TXT records in your DNS. Manually managing TXT records can lead to error or inconsistency.
The CNAME format should be as follows:
trellix1._domainkey.domain.com > {generated_selector1}.fireeyecloud.com
trellix2._domainkey.domain.com > {generated_selector2}.fireeyecloud.com
Use the "Copy Hostname" button to copy the CNAME address.
The TXT format should be as follows:
trellix1.domainkey.domain.com > TXT record value: of selector1
trellix2.domainkey.domain.com > TXT record value: of selector2
Use the "Copy Public Key" button to copy the TXT record value.
To validate the DKIM keys:
Next to the key, click Validate.
Select a domain from the Domain dropdown.
Click Proceed.
When the key is verified, the checkmark in the Verified column turns green. Repeat this process for the secondary key.
To associate the policy to a domain or domain group:
From the Domains page, select a domain or domain group.
Under Policies - Outbound, select Manage next to DKIM Configuration.
Click the Change link to specify a policy, or Manage if a policy is already associated with the domain.
Select a policy.
Click OK.
Click Save.
The policy is now associated to the domain or domain group.
Regenerating DKIM keys
You can regenerate keys to upgrade or downgrade the key strength.
To regenerate DKIM keys:
Open the policy page of a DKIM policy.
Next to DKIM Configuration, select Manage.
Select Regenerate Key.
Select your key length: 1024 or 2048 bits.
Click Submit.
After regenerating the keys, allow a few minutes to make sure the keys are propagated.
After the keys have regenerated, rotate the keys to make the newly created key the primary key.
Rotating DKIM keys
Rotate DKIM keys to change which selector is the primary key.
Trellix recommends that you use a key to sign outgoing email before switching the key from being the primary key to the secondary key.
It is not advised to rotate keys frequently. Trellix recommends waiting at least a week before regenerating the keys or rotating them again.
To rotate DKIM keys:
Open the policy page of a DKIM policy.
Next to DKIM Configuration, select Manage.
Select Rotate Keys.
Select Proceed.
The secondary selector becomes the primary key.