This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(208, 34%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EK%3C/text%3E%3C/svg%3E)
Hello everyone and thanks for the help in advance. I set up an on-premise Exchange 2019 Server. The server will manage email for 3 different domains. The DNS records are all currently set up through Network Solutions rather than the on-server DNS. The issue I am having is delivery issues, mostly due to spam blockers. I have read a little about DMARC records but am confused on how to set these up, especially if there is more than one domain. I did do some lookups using MXToolbox that say there is no DMARC or reverse DNS lookups, so I am likely doing something wrong. Any help would be appreciated.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(73.60000000000001, 94%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELM%3C/text%3E%3C/svg%3E)
Hi @Kmcnet ,
There is no out-of-the-box support for DKIM and DMARC in Microsoft Exchange, but there are third-party solutions available.
Besides, DMARC is built on top of SPF and DKIM, so you need to implement both in your environment and make sure they both work.
For information on how to set up DKIM and DMARC on-premises Exchange Server, please refer to the following articles:
[1] https://colinwilson.uk/2017/07/19/setting-up-dkim-for-exchange-server/
[2] https://jaapwesselius.com/2016/08/22/senderid-spf-dkim-and-dmarc-in-exchange-2016-part-ii/
[3] https://jaapwesselius.com/2016/08/23/senderid-spf-dkim-and-dmarc-in-exchange-2016-part-iii/
Please Note: Since these web sites are not hosted by Microsoft, the links may change without notice. Microsoft does not guarantee the accuracy of this information.
Thank you for the response. So to completely understand your response, simply setting up a SPF record is insufficient for most ISP and mail hosts and therefore requires the use of DKIM and therefore third-party software. So basically, Exchange will not work in the wild out of the box without some type of DKIM add-on to aid delivery. Not trying to take shots at Microsoft, but really trying to get by brain around a very broad topic.
You can route your mail outbound through a cloud solution like Exchange Online Protection and get DKIM that way
https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/use-dkim-to-validate-outbound-email?view=o365-worldwide
Thanks for the response as well as from LilyLi2. I will evaluate both methods.
FYI: This may work for small orgs, the to EOP connectors thresholds are not publicized by MS for bulk.
hi David, with the undocumented, relay limits via the Exchange connector to EOP, and the newly to be introduced reduced 2000 sends per mbx ber day, as well this solution to re-route via EOP instead is not ideal. We did experience throttling, depending on the load via EOP/EXO. Frankly I was hoping and would request that Microsoft in the "NEXT" Exchange version would have this "out-of-the-box support for DKIM and DMARC in Microsoft Exchange" added to the Exchange Edges functionality.