Hellooo!
I wanted to post this topic on uncategorized because this is a more complicated issue?
I have set up all DNS Records (mail._domainkey.brotherway.eu) for this Domain as suggested in the admin panel of the box, but it seems that the DKIM signature still fails, is it because of my faulty DNS configuration or because of the MiaB?
Hello
DNS is hosted on MiB or externally at the provider (in our case, domain registrar and DNS) I use external and in MiB I only listed it as secondary, for example: ns1.xxxx.cz and I set the rest at the provider. Nothing in MiB
Well I am hosting DNS externally and have set up everything accordingly but it seems that there is a problem maybe with the Box itself? It does not sign the mails with DKIM although the TXT record has been set. There is also a problem with DNSSEC where my DNSKEYs, RR Signatures (NSEC3 and bla bla bla) has been set up correctly, but the Box struggles “marking” it as “externally set up”, but this is of course another topic for another day.
The TXT is for external mail servers to validate the dkim signature. Your mail server does not depend on this txt record. Check the headers of mails sent by your server to see if there is a dkim header.
Furthermore, I can’t see the complete TXT record, but verify it is the same as provided by the box.
You can also use learndmarc.com which might enlighten the issue at stake here.
Finally, temporarily disable dnssec, then get all dns specific stuff to work, and only then re-enable dnssec. Easier to debug that way.
I’ll describe it the way I solved it myself: originally I entered the data generated by MiB into the external DNS and that was wrong, the correct data, i.e. the domain key, was generated for me at the request of the domain registrar and DNS provider and everything works.
Windows (Server) DNS does not like characters that exceed 255, I am going to fix this issue now. Thanks!
I have disabled DNSSEC in the past and activated it again. I mean, I am using the Zone Signing Key and Key Signing Key of Windows and entered it at my registrar. Maybe it differs with the Box’s ZSKs and KSKs? At least everything is correct here? (Source PowerDMARC)