James,

In order for DKIM to work, out-bound messages MUST go through Xeams. If Exchange sends them out to the Internet, your out-bound email will never have a DKIM signature (unless off course you configure Exchange to sign them).

When in-bound messages come from the Internet to Xeams, it will only validate the existing signature. It will not sign the message.

We strongly recommend you use Xeams for out-bound email as it learns from what goes out and filters get better. Check http://xeams.com/filteroutbound.htm for details.