Summary
IMSVA does not sign outgoing mails even if DomainKeys Identified Mail (DKIM) signing is configured and enabled, or in other words, DKIM signature is not added to the mail header.
In Postfix mail log (maillog), the following error message is seen:
Dec 6 18:02:53 imsvahost dkim[5203]: (unknown-jobid): skipping signing of mail to 'someone@somedomain.com'
In older IMSVA versions, the wildcard "*" would have to be added to the internal address list to configure a " from anyone to anyone" policy. When upgrading or migrating from these older versions, the internal address list will be inherited even though the new version doesn't require the wildcard in the list. When the wildcard "*" is in the internal address list, the DKIM signing feature will skip signing all mails as it is not supposed to sign incoming mails.
To resolve this issue:
- Go to the IMSVA web UI and navigate to Policy > Internal Addresses.
- Check if the wildcard "*" or the target domain has been added to the internal address list.
- If "*" or the target domain are on the list, remove them.
- Click Save.
- Verify if IMSVA can now sign the outgoing mails.
This solution will impact the statistics on incoming and outgoing mails. However, the change actually should be expected because the previous statistics are incorrect.