Default Exchange Configuration causes DKIM to skip signing

[WesleyDudzinski]

Versions

• Windows Server Version: Windows Server 2012 R2 Standard
• Exchange Version: Exchange 2013 CU15 (15.0.1263.5)
• Installed DKIM Exchange Version: 3.0.8

Description

Installed and configured software. DKIM Signer skips signing all outgoing messages

Steps to Reproduce

1. Configured the software for netnut.org domain. Set debug to 4.
2. Created new message. Server Event Viewer shows:
   DEBUG: Got new message, checking if I can sign it...
   DEBUG: Message is a System message or of TNEF format. Not signing.

Expected behavior: I expected to see in the message header:
Authentication-Results: spf=pass (sender IP is 173.228.107.99)
smtp.mailfrom=netnut.org; arm.com; dkim=pass (signature was verified)
header.d=netnut.org;arm.com; dmarc=pass action=none
header.from=netnut.org;arm.com; dkim=pass (signature was verified)
header.d=netnut.org;

Actual behavior: I received:
Authentication-Results: spf=pass (sender IP is 173.228.107.99)
smtp.mailfrom=netnut.org; arm.com; dkim=none (message not signed)
header.d=none;arm.com; dmarc=pass action=none header.from=netnut.org;arm.com;
dkim=none (message not signed) header.d=none;

3. Checked the Internet and found that the default TNEF configuration for the Remote Domains appears to be set to $null.

Used PowerShell to disable TNEF:
Set-RemoteDomain -Identity * -TNEFEnabled $false

Restarted the Transport Service and now the Event Viewer shows:
DEBUG: Got new message, checking if I can sign it...
DEBUG: Parsing the MimeMessage
DEBUG: Signing the message
DEBUG: Got signing header: v=1; a=rsa-sha256; d=netnut.org; s=selector; c=simple/simple; t=1483398561; h=from:subject:to:date:message-id; bh=NPY9QyAWirTIwADJYGyfK2SgoOeohBNbLYEp9GJx48Q=; b=Kbs9zMPWHozrG7DKi/VfC/N0nPNhfZwxlUFhoOMHa6rl9PKJUlvzAXnowv/NggHuxXuX8R2dNcTn0bKqhkgN3v3FiZBr0jhVu1nfZzBtVO/bBXU1TYfxbUiFYOZI2WLHOHY5vGHT1JpMgFFF6yeEREj3lZjQPEM847jsOfWeysg=

Reviewed the header at the recipient end and it confirms it has been signed.

Regards,

Wes

[Pro]

Thanks for the hint!

I'll add that to the documentation. Deciding if TNEF is enabled or not should be the responsibility of the Admin and not the install script.