In my previous post I described a catch-all email forwarder built on Haraka, and I waved at the bring-your-own-domain case with one lazy sentence: "a small additive queue_outbound hook that reuses the DKIM signing stream." That sentence hid the hardest part of the whole system. This post is the part I skipped: how to DKIM-sign outbound mail for hundreds of customer domains , with per-tenant keys living in a database, from a single Haraka instance. It's what powers custom domains ...