Skip to main content
The40ITGuy
The40ITGuy
Explorer III
January 14, 2025
Solved

Configuring DKIM for Fortimail in Transparent Mode

  • January 14, 2025
  • 2 replies
  • 1080 views

Hello Everyone,

I want to configure DKIM on our Fortimail unit to sign outgoing messages, but I have a lot of questions that I need your help with. First of all, our Fortimail unit is 200F unit, working in transparent mode. We have 2 protected domains configured inside this unit. The two domains are MS exchange servers

For my questions:

  1. Can I configure the DKIM signing in Transparent mode, or it should be in gateway or server mode for this to work?
  2. If it is applicable in transparent mode, and I successfully configured it, will this configuration be affected or stop working if I change the working mode of the fortimail unit to gateway mode?
  3. Do I have to make a record for the DKIM inside my exchange servers internal DNS, or it should be published only on the external DNS?
  4. Does the protected domains SSL certificates have to be imported inside the Fortimail, or the DKIM has nothing to do with the certificates?
  5. Is it better to configure the DKIM inside my exchange servers, or it's better to be configured on the Fortimail, and does it have anything to do with the encryption of the email messages (meaning that encrypted messages from the mail server should affect the DKIM if it is configured on the fortimail unit)?

I would greatly appreciate your support on these topics

#Fortimail

Best answer by AEK

Hi ITGuy

  1. Yes you can configure DKIM signing in transparent mode
  2. Changing from one mode to another will reset you config to factory defaults, so you will also lose domain config and DKIM private keys as well
  3. No need for DKIM public key in you private DNS, it should be in your public DNS so remote servers can check it
  4. DKIM doesn't use any certificate. It needs only a public key and a private key
  5. I think is better to configure it on FML, I always do that just in case FML changes something in the message or in the headers, in that case the DKIM has to operate at FML level, otherwise it will not be valid anymore

2 replies

AEK
SuperUser
AEKAnswer
SuperUser
January 14, 2025

Hi ITGuy

  1. Yes you can configure DKIM signing in transparent mode
  2. Changing from one mode to another will reset you config to factory defaults, so you will also lose domain config and DKIM private keys as well
  3. No need for DKIM public key in you private DNS, it should be in your public DNS so remote servers can check it
  4. DKIM doesn't use any certificate. It needs only a public key and a private key
  5. I think is better to configure it on FML, I always do that just in case FML changes something in the message or in the headers, in that case the DKIM has to operate at FML level, otherwise it will not be valid anymore
AEK
    The40ITGuy
    The40ITGuyAuthor
    Explorer III
    January 16, 2025

    Thanks a lot @AEK

    Those answers will help a lot in considering the best approach to apply the DKIM in our configuration

      Terms & ConditionsAccessibility statement
      Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
      Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!