A Cisco Secure Email Gateway administrator must provide outbound email authenticity and configures a DKIM signing profile to handle this task. What…

After creating a DKIM signing profile on a Cisco Secure Email Gateway (SEG), the system generates a public/private key pair. The private key is used to sign outbound emails. The corresponding public key must be published in the public DNS of the sending domain. This allows receiving mail servers to retrieve the public key and verify the DKIM signature. Therefore, the immediate and necessary next step is to export the generated DNS TXT record containing the public key and provide it to the DNS administrator for publication.

A. Enable the DKIM service checker: The DKIM service checker is used for verifying DKIM signatures on inbound email, not for enabling outbound signing.

C. Import the DNS record of the service provider into the Cisco Secure Email Gateway: This action is incorrect; for outbound DKIM, you export/publish your own public key to your DNS, not import a record from a service provider.

D. Configure the Trusted Sender Group message authenticity policy: This policy is typically used for evaluating the authenticity of inbound mail from trusted senders, not for applying an outbound signing profile.

1. Cisco Secure Email and Web Manager User Guide

15.0

"Email Security Manager > Email Policies > DomainKeys Identified Mail (DKIM)" section.

The guide outlines the configuration workflow. After creating a signing profile and generating keys

the next step is: "Publish the public key for the signing key to the DNS server for the signing domain." It further states

"You can view the public key and the DNS record that you must create... Copy the text for the DNS record and provide it to your DNS administrator." This directly supports option B as the correct next step.

2. Cisco Secure Email Gateway Configuration Guides

"Configuring the Email Gateway to Sign Outgoing Messages Using DKIM" chapter.

The procedural steps confirm that after creating the signing key and profile (Step 2 and 3)

the administrator must perform Step 4: "Publish the Public Key to DNS." The guide explicitly details that the appliance provides the TXT record to be published

which must be given to the DNS provider. Applying the signing profile to an outgoing mail policy is the final step (Step 5)

which can only be effective after the public key is published.