Configure DKIM for Email server with DMARC policy which does not allow to deliver emails comming from Salesforce

Question

The company where I'm implementing salesforce has an Email server Exchange (office 365). They have activated a policy that forces all comming emails must have DMARC=true.

This policy avoid to deliver emails where "from" is an address with the email server domain, but in the header the the sender is diferent. For example:

Let's say the server email domain of this company is "@company.com". So, when a SF user who has an email like "user1@company.com" triggers a workflow that sends an email to another user (lest say, user2@company.com), the "From" of the email is "user1@company" but in the header the real "Sender" is something like "fdsadf7kdf@a409d0fkdñdlfdf.salesforce.com". So, the email server wont allow to deliver the email to the recipient user2@company.com

Then,the technical support of Exchange server, said that this could be resolved if salesforce sends the email with DKIM=true, so I tried to configured DKIM.

I followed this steps: https://help.salesforce.com/articleView?id=emailadmin_create_dkim_key.htm&type=5

But I dont understand what I have to do in the last step: 7: "Publish your public key in DNS. Use this format for the file name txt: selector._domainkey.domain.com Use v = DKIM1; k = rsa; p = {yourPublicKey} for the value of txt file.

I dont know what I have to ask to the Email server Admin and what I have to do.

Someone could help me on this?

Answer 1

You'll have to ask him/her to have a public DNS TXT Resource Record (RR) created:

[selectorName]._domainkey.[yourDomain] IN TXT "v=DKIM1; k=rsa; p=[yourPublicKey]".

You can probably leave the TTL 'as is' or request it to be set to 3600. These records are fairly static and seldom need to change.

Not sure if it will be your email server admin or your DNS admin, though.

Answer 2

Thank you very much Rein.

There was also many things that are not completely clear in Salesforce documentations for people like me, who are not expert in that part of server conf and DNS etc..

So following, I explain how I solved my problem and explain for peolple who are lost as I was:

1. Create the DKIM:

2. In exchange there is an option where you can add the DNS, so I ask to email admin, to add the next record there called alike this: COMPANY.domain_key.COMPANY.COM

The text of the record must said:

v=DKIM1; k=rsa; p=MDOasdfoj0987asd0f987asdf....fasdfasdf; (Put the public key generated in SF in the previous step).

3. This is the part that I didnt know: After maximum 24 hours, the email server must publish the the key and SF will detect it. To know wheter the key was publish correctly, in SF DKIM config, you will note that changed from this:

To this:

With this configuration, is almost completely sure that email will always come to user inbox.