Fixing issues with Microsoft 365 DKIM

The issue with DKIM and email encryption

Microsoft 365 allows DKIM signing as explained in the Microsoft documentation here: Use DKIM to validate outbound email sent from your custom domain in Microsoft 365.

DKIM is a very efficient measure against Spam by achieving two things:

Using public/private keys to confirm that the sender is really who he claims to be.
Making sure that emails are not tampered with on their way from Microsoft 365 to the final recipient.

It is the second part that causes problems with encryption solutions because emails need to be decrypted after they have already been signed by Microsoft 365. This triggers the "tamper alert", leading to emails being bounced by many mail systems.

A possible workaround

The easiest way to avoid this is simply to disable DKIM signing in Microsoft 365. Activation is described in the Microsoft documentation here: Use DKIM to validate outbound email sent from your custom domain in Microsoft 365.

Deactivation works just the other way around.

This workaround will make sure mails can be delivered, but it also weakens the overall reputation of your emails by not using state-of-the-art anti-spam measures. Also, in some companies, security solutions are not managed by the same department as the mail solution. This can lead to mail admins activating Microsoft 365 DKIM in good faith, but effectively disrupting the mail flow.

Our recommended approach

To make sure this cannot happen in your environment, we recommend a two-step approach:

Automatically remove DKIM related headers from your emails in case of accidental activation of Microsoft 365 DKIM.
Signing outbound emails with your own DKIM keys.

Both measures can be combined, but if you implement Step 2, Step 1 is not absolutely necessary.