1

Does it provide any trust at all to have DKIM set up correctly in my DNS but not sign any emails? I could not find any information about that.

Now, if I send an email to a domain/server with DMARC set up, with policy=reject and adkim=strict, will all my mails be rejected? If so, it would be better to just ignore DKIM, right?

schroeder
  • 123,438
  • 55
  • 284
  • 319
Hannes
  • 13
  • 2

1 Answers1

0

Does it provide any trust at all to have DKIM set up correctly in my DNS but not sign any mails?

This does not make sense. You are essentially only adding junk to the DNS, i.e. information which are used nowhere.

Now, if I send an email to a domain/server with DMARC set up, with policy=reject and adkim=strict, will all my mails be rejected? If so, it would be better to just ignore DKIM, right?

adkim only specifies how the sender alignment is done between the RFC822.From header in the mail and the domain specified in the DKIM signature. If the sender does not add any DKIM signature then the value of adkim is irrelevant.

If the DMARC policy is reject and the sender adds no DKIM signature then SPF must match or the mail gets rejected. This means there must be a SPF record for the domain, the SPF lookup must pass and the SMTP.MAILFROM must be aligned with the RFC822.From.

Steffen Ullrich
  • 184,332
  • 29
  • 363
  • 424