DKIM Verification: Both Must Be Set to On

Luke Hebert

- 2 minutes read - 359 words

Exim ships with two DKIM-related settings that are easy to overlook, and leaving either one at its default can leave your inbox exposed to spoofed or unsigned mail. The two toggles work in tandem: one controls whether Exim even performs the verification, and the other determines what happens when a message fails that check.

Allow DKIM Verification for Incoming Messages

By default, Exim verifies syntactically valid DKIM signatures in incoming mail, even when it is not configured to act on the results. This means the DNS lookups and cryptographic checks still run, which can degrade server performance under load.

  • On (default): Exim performs DKIM verification on incoming messages.
  • Off: Exim skips DKIM verification entirely, saving CPU and DNS query overhead.

Reject DKIM Failures

This setting tells Exim what to do when a sender’s DKIM signature does not validate.

  • On: Exim rejects the message at SMTP time if the sender fails DKIM key validation.
  • Off (default): Exim logs the failure but still accepts the message.

Why Both Must Be Set to On

Setting only one of these toggles creates a gap:

  • Verification On + Reject Off: Exim does the work of checking signatures but then accepts the mail anyway. You pay the performance cost with no security benefit.
  • Verification Off + Reject On: Exim has no verification result to act on, so the reject rule never triggers.

For a production mail server that wants to enforce sender authenticity, set both toggles to On. This ensures Exim validates the DKIM signature and rejects any message that fails, giving you a meaningful layer of protection against spoofed domains and unsigned bulk mail.

Important

Before enabling rejection, confirm that your own outbound mail is properly DKIM-signed. If your sending infrastructure does not publish a valid DKIM record, you will start rejecting your own legitimate mail.

Verifying Your Configuration

After making the change, send a test message from a known DKIM-signed domain and inspect the Exim log for a line similar to:

DKIM: signature from example.com verified OK

If you see DKIM: signature from example.com failed, double-check that the selector and public key published in DNS match what the sending server is using.