[Email DLP] Confirming the Effectiveness of DKIM Setup

Question

I have set up a DKIM Record, but is there a way to confirm whether it has been configured correctly?

Answer

You can check the record and the received email.

Checking the DNS Record

1. Log in to the Email DLP management console and access ［Tenant Settings］－［DMARC Coverage Dashboard］.
   Accessing Method to Email DLP Management Console

2. Click the Domain for which you want to check the status.

   

3. If the ［DKIM］ item is ［enable］, the DKIM Record has been configured correctly.
   ※ If it is ［disable］, refer to the following article and check the settings.
   [Email DLP] What to Do When "Not Activated" is Displayed in DMARC Status?

   

Checking the Incoming Email Header

To confirm that the DKIM signature enabled in Email DLP is being verified correctly by the destination server, check the header of the received email.
※ For instructions on how to check email headers, refer to the manual of your email software.
※ The following explanation uses an email header obtained from Gmail as an example.
※ This assumes that the setting to add a DKIM signature has been configured in both Google Workspace / Microsoft 365 and Email DLP.

When Attachments exist (ZIP encryption / converted to URL by Secure Download)

Items to Check

1. Authentication-Results header

   ※ In Test Mode, the following items to check are displayed as dkim=pass (test mode).

   • Confirm that ［header.s=］ contains the Email DLP Selector Name and that ［dkim=］ on the corresponding line is "pass".
   • Confirm that ［header.s=］ contains the Google Workspace or Microsoft 365 Selector Name and that ［dkim=］ on the corresponding line is "neutral (body hash did not verify)".
   • Confirm that ［arc=］ is "pass" and that "dkim=pass" is included in the parentheses ().
      
2. DKIM-Signature header
   • Confirm that ［d=］ is the domain name of the sender address to be DKIM-verified.
   • Confirm that ［s=］ is the Selector Name configured in Email DLP.
3. X-HDEMS-MO-TENANT header
   • Confirm that this header exists and that its value is your tenant domain.

※ Your tenant domain is included in the URL of the Email DLP management console. (https://console.mo.hdems.com/#/(tenant domain))

When Attachments do not exist (no ZIP encryption / no conversion to URL by Secure Download)

Items to Check

1. Authentication-Results header
   • Confirm that ［dkim=］ is "pass".
2. DKIM-Signature header
   • Confirm that ［d=］ is the domain name of the sender address to be DKIM-verified.
   • Confirm that ［s=］ is the Selector Name configured in Email DLP.
3. X-HDEMS-MO-TENANT header
   • Confirm that this header exists and that its value is your tenant domain.

※ Your tenant domain is included in the URL of the Email DLP management console. (https://console.mo.hdems.com/#/(tenant domain))

References

• [Email DLP] Tenant Settings - DKIM Settings
• [Email DLP] Add a Domain to an Existing DKIM

Translation Disclaimer

This article has been automatically translated from the original Japanese version for your convenience.
While we strive to ensure accuracy, we cannot guarantee its reliability or completeness.

In the event of any discrepancies or questions regarding the content, the official Japanese version shall prevail.