C# | jstedfast/MimeKit | Office 365 connector with DKIM setup

Question

DKIM is set up for a domain in Office365. A .Net application (currently MVC 4) sends Email through an O365 connector to external parties. We'd like to sign these using DKIM as well.

I'm not quite clear about the entire process. MimeKit's Documentation is reasonably clear. I suppose I can use any pub/priv key generator such as Putty to generate a keypair? I would then store the private key in a way that the C# application can read it into

var signer = new DkimSigner ("privatekey.pem") {
   SignatureAlgorithm = DkimSignatureAlgorithm.RsaSha1,
   AgentOrUserIdentifier = "@eng.example.com",
   QueryMethod = "dns/txt",
};

The public key will be published as a DNS record for my domain. Unfortunately, the Office 365 documentation isn't all too clear on the exact how.

Summary Questions

• What exactly goes into AgentOrUserIdentifier , if my system sends with the address application@example.org ?
• How exactly would I publish my generated public key to Office 365?

Any enlightening summary would be greatly appreciated, thanks.

Answer 1

I'll accept @jstedfast's answer (although without really understanding it). Just in case anyone else is struggling with this, here's the complete walk-through:

Get a public/private key pair. You can use Puttygen or openssl directly, but it's easier to use (oh had I only known beforehand) sth like https://port25.com/dkim-wizard/

Specify your domain name (example.org here) and a "selector" - this could be your application name ("greatapp"). This selector will be the TXT record for the public key in DNS. Create an additional DNS (TXT) record; leave the Office365 ones intact. Since they rotate keys regularly you want an additional record that you can control. greatapp._domainkey.example.org IN TXT "k=rsa\\; p= here goes the stuff between -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- ", so eg "k=rsa\\; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAhvIwVBomj+dx2CEBbY/ZpSdnQK2Omx6ZNyHsuvC3MMJYNLQ069ajuJo5FP......."

Copy the private key to a file, or use it in your code directly. MimeKit either expects a file or a stream, so for the quick & dirty example here I'm using a string:

var mail = new MimeMessage();
mail.From.Add(new MailboxAddress("Justin Case", "justin@example.org"));
mail.To.Add(new MailboxAddress("Candy Barr", "candy@example.org"));
... subject etc
var privateKey = @"-----BEGIN RSA PRIVATE KEY-----......";
var privateKeyStream = new MemoryStream(Encoding.Default.GetBytes(privateKey));
mail.Sign(new DkimSigner(privateKeyStream, "example.org", "greatapp", DkimSignatureAlgorithm.RsaSha256), new HeaderId[] { HeaderId.From, HeaderId.Subject }, DkimCanonicalizationAlgorithm.Simple, DkimCanonicalizationAlgorithm.Simple);

... Connect client and send.

Thanks to jstedfast something as awesome as MailKit/MimeKit exists, don't forget to donate.

Answer 2

From rfc6376, section 2.6 :

2.6. Agent or User Identifier (AUID)

A single identifier that refers to the agent or user on behalf of whom the Signing Domain Identifier (SDID) has taken responsibility. The AUID comprises a domain name and an optional <local-part>. The domain name is the same as that used for the SDID or is a subdomain of it. For DKIM processing, the domain name portion of the AUID has only basic domain name semantics; any possible owner-specific semantics are outside the scope of DKIM. It is specified in Section 3.5.

Note that acceptable values for the AUID may be constrained via a flag in the public-key record. (See Section 3.6.1.)