DKIM (DomainKeys Identified Mail) is used by Office 365 to digitally sign outgoing messages. Once Xink adds a signature to a message that already been sent, DKIM signature gets broken. In most scenarios Xink would remove DKIM signature at all, and later, when the message reaches Office 365 after processing by Xink engine, Office 365 adds digital signature again.


But in several scenarios, say if a message is targeted to the same Office 365 tenant that sent the message, DKIM signature will never be restored again.


Xink ReRouter can add DKIM signature after inserting message signature. This feature is supported on per-domain basis. 

It is enough to add the following CNAME record to your domain:


xinkrr._domainkey    CNAME    xinkrr._domainkey.xink.io.


(please note trailing dot, it is required)


Changes will not be visible immediately, it might take up to 72 hours for DNS changes to propagate and take effect. Xink engine checks DNS record at least daily and enables DKIM signature for outgoing message if sender's domain contains the record mentioned above.