It appears that xaf via mailop <[email protected]> said: >xaf via mailop a écrit le 28/08/2026 à 03:02 : >> Benny Pedersen via mailop a écrit le 27/08/2026 à 21:39 : >>>> As Rainer suggests, a single DKIM key for all and a CNAME record for >>>> each domain is arguably the best solution. >>> CNAME breaks DNSSEC >> No, that's fine, but DNSSEC must also be enabled on each external target >> (MX, CNAME). >> The target MX or CNAME domain must be signed to be compatible with all >> domains, whether signed or unsigned. > >Sorry, the target MX domain should only be signed if you wish to use DANE.
That's not right either. You do need to sign the MX domain if you want to use DANE, but there's no harm in signing it even if you don't. R's, John PS: I have to say I find the level of misunderstanding about DNSSEC here kind of surprising. _______________________________________________ mailop mailing list [email protected] https://list.mailop.org/listinfo/mailop
