Configuring DKIM for Email Header Signing in Exchange Online

The core concept tested here is the mechanism used to digitally sign email headers to verify sender authenticity and prevent tampering during transit. The question specifically asks for a technology that adds a digital signature to the headers of emails sent from Microsoft Exchange (Exchange Online).

DKIM (DomainKeys Identified Mail) is the correct solution. DKIM works by adding a cryptographic signature to the email headers using a private key stored in the organization's DNS records. When an email is sent, Exchange Online signs specific header fields. Receiving servers use the corresponding public key in DNS to validate this signature, ensuring the message has not been altered and originates from the authorized domain. This directly matches the requirement to "ensure that the message headers... are signed digitally."

DMARC (Domain-based Message Authentication, Reporting, and Conformance) relies on both SPF and DKIM being configured, but its primary function is to define policies for handling failed authentication checks and to provide reporting mechanisms. It does not itself add the digital signature; it orchestrates the validation of signatures added by other mechanisms like DKIM.

ARC (Authenticated Received Chain) is designed to preserve authentication results when emails are forwarded through intermediate systems (like mailing lists), allowing the original signature to remain valid across multiple hops. It is not the primary method for initial signing of outbound mail.

Microsoft Purview Message Encryption involves encrypting the content of the email body and including a link for recipients to view the message securely. While it enhances security, it focuses on confidentiality rather than the digital signing of headers for integrity and origin verification.

Therefore, configuring DKIM is the precise action required to achieve digital signing of message headers.