Klytic

Home›Guides›Email security

Email security · Use Klytic MTA

DKIM signing, S/MIME signing and recalling outgoing mail

Klytic MTA does more than filter what comes in. Mail sent through the gateway can be DKIM-signed, even if your email service does not do so, and held for a brief moment to catch a message sent too hastily. If your email service does not support S/MIME, Klytic MTA can also S/MIME-sign your messages with your key, provided you choose to enable this option and entrust it with the key.

Updated October 20265 minHow-to Klytic MTA

What you get

FeatureEssentialAdvanced
DKIM signing of outgoing email, even if your email service does not do itIncludedIncluded
Recall before a message is sentIncludedIncluded
S/MIME signing by the gateway, with your key, if you enable itIncludedIncluded
S/MIME certificate supplyOptionOption

These features apply to mail that goes through Klytic MTA. Your email service, whether Microsoft 365, Google Workspace, Exchange, Klytic Mail or another server, must therefore hand its outgoing messages to the gateway, which then forwards them to recipients. Klytic prepares this route with you during onboarding. Prices are on the Pricing page.

Who does what

  • Your email administrator routes outgoing mail through Klytic MTA, following Klytic’s instructions.
  • The person who manages your domain’s DNS publishes the DKIM public key and updates the SPF record.
  • The domain administrator in Klytic MTA decides the sending policy: signing and send delay.
  • Klytic prepares the configuration and provides the values to publish.
  • The user sends as usual, and can catch a message during the send delay.

DKIM-signing your mail

A DKIM signature lets the recipient’s server verify that the message really comes from your domain and was not altered in transit. It improves deliverability and makes spoofing your domain harder. Klytic MTA can add it even if your current email service does not sign, which is useful when you keep Microsoft 365, Google Workspace or another server.

  1. Klytic prepares the signature for your domain and gives you the DNS record to publish, which contains the public key.
  2. Your DNS manager publishes this record. They also update the SPF record, which must now include the gateway as a sending server.
  3. Once the outbound route is in place, send a test message to an external address and display its headers: a DKIM-Signature line mentioning your domain should appear.

Each protected domain gets its own signature. A message can carry several DKIM signatures: if your email service already signs, the signature that counts for DMARC is the one matching the sender’s visible domain.

If you publish a strict DMARC policy, update SPF and DKIM before routing mail through the gateway, not after. What these mechanisms mean is explained in SPF, DKIM and DMARC: what they protect, and what they do not.

The send delay

A message sent too quickly, to the wrong recipient or with the wrong attachment, cannot be retrieved once delivered. Klytic MTA can hold outgoing messages for a short delay before forwarding them. During this window, the message can be recalled; after that, it goes out normally.

The delay is set in the domain’s sending policy. How to recall a message during the window is explained to your users during onboarding.

This delay is a gateway feature, not a feature of your email software. Do not confuse it with the recall function of some email clients, which asks the recipient after the fact to delete a message already received: here, the message has not yet left your domain.

Example. A payroll officer sends the salary file to “Julien,” and autocomplete picks a customer’s Julien instead of her colleague in the department. She notices immediately. The message is still held by the gateway: she recalls it before it goes out.

A message held for this delay is not in quarantine. Quarantine concerns dangerous incoming mail: see Quarantine, false positives and reporting.

S/MIME signing when your email service does not offer it

S/MIME relies on a certificate tied to an email address. An S/MIME signature lets the recipient verify who sent the message and that it was not altered along the way.

Many email services can S/MIME-sign from the user’s device. If yours cannot, Klytic MTA can do it instead: the gateway signs the outgoing message with the sender’s key before forwarding it to the recipient.

A customer decision

  • You choose to enable it. S/MIME signing by the gateway is never set up by default.
  • You entrust your key to Klytic MTA. To sign on your behalf, the gateway must hold the private key matching the certificate. This choice is yours: it means accepting that the gateway operator uses this key to sign your outgoing mail.
  • The certificate can be your own, or supplied by Klytic: certificate supply is an option, in both plans.

If you prefer the private key never to leave your devices, sign from an email service that supports S/MIME and leave this option disabled. The guide What is a sovereign cloud? explains why key ownership matters.

MechanismWhat it protects
Transport encryption (TLS)The route between two servers. Toward another domain, it also depends on the receiving server.
DKIM signatureThe authenticity of the sending domain, verified by receiving servers.
S/MIME signatureThe sender’s identity and the message’s integrity, verified by the recipient.

Limits

  • The gateway signs and holds only mail that goes through it. Messages sent directly by other services on behalf of your domain, such as a newsletter tool or invoicing software, are configured separately.
  • Once the delay has elapsed, a sent message can no longer be recalled by the gateway.
  • S/MIME signing by the gateway exists only if you have enabled it and entrusted your key to Klytic MTA.

None of this requires Klytic Mail. If you keep your current email service, see Protecting the email system you already have.

Frequently asked questions

Do I need Klytic Mail to DKIM-sign with Klytic MTA?

No. The signature is added by the gateway, in front of any email service. See Protecting the email system you already have.

What do SPF and DMARC check on my outgoing mail?

See SPF, DKIM and DMARC. The Advanced plan’s DMARC console tracks your domains’ reports: see Reading and exporting a filter decision.

Who decides the send delay?

The domain administrator, in the sending policy. The division of roles is described in Who sets the filter in Klytic MTA.

Does Klytic MTA S/MIME-sign my messages without my consent?

No. It is an option you enable, by entrusting your key to the gateway. Without that, Klytic MTA does not S/MIME-sign.

Can I use my own S/MIME certificate?

Yes, certificate supply by Klytic is only an option. Prepare activation with Klytic through the Contact page.

Route your outgoing mail through Klytic MTA

Klytic prepares DKIM signing and the outbound route with your email administrator.

Contact Klytic →

The Klytic MTA offer

Further reading

Understand · Email securitySPF, DKIM and DMARC: what they protect, and what they do notSPF, DKIM and DMARC prevent others from using your exact domain. They do not read the message: what they stop, what gets through, how to deploy them.6 min readRead →Understand · Email securityProtecting the email system you already haveMicrosoft 365, Google Workspace, Exchange: you can add a security gateway without changing email services. What changes, who sets it up, the limits.7 min readRead →Use · Email securityWho sets the filter in Klytic MTAThe five rule tiers in Klytic MTA, their order, and who sets each one: the operator, the domain administrator or the user.5 min readRead →

Welcome offer

30 days free trial, migration support included

No-commitment trial. An advisor calls you back to understand your needs and prepare your Klytic workspace.

🚀 Start the free trial See pricing