Scenario
You are using Exclaimer Server-Side email signatures and notices that DKIM headers are missing or removed from messages after processing. This can lead to questions about whether Exclaimer supports DKIM, re-signs emails, or applies Authenticated Received Chain (ARC) sealing.
Reason
DomainKeys Identified Mail (DKIM) works by applying a digital signature based on the exact content of an email message.
When Exclaimer applies a Server-Side signature, the message content is modified and because of this change:
Any existing DKIM signature becomes invalid
The DKIM signature is therefore removed during processing
Exclaimer does not DKIM sign or re-sign emails, does not apply ARC sealing, and cannot be configured to DKIM sign mail on return connectors.
Resolution
This behavior is expected and does not require any additional configuration.
After Exclaimer finishes processing the message, it is returned to Microsoft 365 or Google Workspace, which automatically applies a new DKIM signature for external delivery.
• DKIM is removed only when a Server-Side signature is applied.
• Internal messages may not always display DKIM headers.
• External messages are automatically DKIM signed by Microsoft 365 or Google Workspace.
• Exclaimer does not provide DKIM signing or ARC sealing itself.
Exclaimer does not sign outbound mail using customer DKIM keys and does not apply ARC seals. DKIM signing is performed by the final sending platform (Microsoft 365 or Google Workspace) after Exclaimer has finished modifying the message.
ARC sealing is not currently supported, but may be considered as a future enhancement.
If Exclaimer does not DKIM-sign your emails, or DKIM checks fail, complete the following checks before contacting Support.
1. Confirm that your DKIM DNS records are published and valid
Use an online tool such as MXToolbox to run a DKIM lookup for your email domain.
If you use Microsoft 365:
Check both DKIM selectors. In the MXToolbox DKIM lookup tool, enter your domain with each selector:
yourdomain.com:selector1
yourdomain.com:selector2
Replace yourdomain.com with your sending domain.
Both lookups should return a valid public key record hosted by Microsoft. If either lookup returns No DKIM Record found, your DNS configuration is incomplete.
You can find the CNAME values that you need to publish with your DNS host in your Microsoft 365 Defender DKIM settings:
Email & Collaboration > Policies & Rules > Threat Policies > Email Authentication Settings > DKIM
For more information, see How to use DKIM for email in your custom domain (Microsoft 365).
If you use Google Workspace:
Run the MXToolbox lookup with the Google selector:
yourdomain.com:google
For more information, see How to set up DKIM (Google Workspace).
2. Rotate your DKIM keys if the records are incomplete
If you have published the correct CNAME values but the DNS lookup still fails, rotate your DKIM keys in Microsoft 365. This prompts Microsoft to update its hosted records.
After rotating the keys, run the DKIM lookup again to confirm that the records are valid.
3. Send a test email
After your DNS records return valid results, send a test email to an external mailbox.
Open the full headers of the received email and check the Authentication-Results entry near the top.
Confirm that it shows:
dkim=pass
4. Contact Support if the issue persists
If your DNS records are valid but the affected email still shows dkim=none after Exclaimer processes it, contact Exclaimer Support.
Attach the full headers of the affected email as a text document to your support request.