diff --git a/README.md b/README.md
index 5020b79..c9f349e 100644
--- a/README.md
+++ b/README.md
@@ -65,6 +65,8 @@ env vars
 * **POSTMOOGLE_TLS_KEY** - space separated list of paths to the SSL certificates' private keys of your domains, note that position on the key list must match the position of cert in the cert list
 * **POSTMOOGLE_TLS_REQUIRED** - require TLS connection, **even** on the non-TLS port (`POSTMOOGLE_PORT`). TLS connections are always required on the TLS port (`POSTMOOGLE_TLS_PORT`) regardless of this setting.
 * **POSTMOOGLE_DATA_SECRET** - secure key (password) to encrypt account data, must be 16, 24, or 32 bytes long
+* **POSTMOOGLE_DKIM_PRIVKEY** - DKIM private key, pre-generated before `!pm dkim` command
+* **POSTMOOGLE_DKIM_SIGNATURE** - DKIM signature, pre-generated before `!pm dkim` command
 * **POSTMOOGLE_STATUSMSG** - presence status message
 * **POSTMOOGLE_MONITORING_SENTRY_DSN** - sentry DSN
 * **POSTMOOGLE_MONITORING_SENTRY_RATE** - sentry sample rate, from 0 to 100 (default: 20)
diff --git a/cmd/postmoogle/main.go b/cmd/postmoogle/main.go
index ce2f725..1d4c8c5 100644
--- a/cmd/postmoogle/main.go
+++ b/cmd/postmoogle/main.go
@@ -127,7 +127,7 @@ func initMatrix(cfg *config.Config) {
 	}
 
 	psdc := psd.NewClient(cfg.PSD.URL, cfg.PSD.Login, cfg.PSD.Password)
-	mxc = mxconfig.New(lp, &log)
+	mxc = mxconfig.New(lp, &log, cfg.DKIM.PrivKey, cfg.DKIM.Signature)
 	q = queue.New(lp, mxc, &log)
 	mxb, err = bot.New(q, lp, &log, mxc, psdc, cfg.Proxies, cfg.Prefix, cfg.Domains, cfg.Admins, bot.MBXConfig(cfg.Mailboxes))
 	if err != nil {
diff --git a/internal/bot/config/manager.go b/internal/bot/config/manager.go
index 693ee79..6d34503 100644
--- a/internal/bot/config/manager.go
+++ b/internal/bot/config/manager.go
@@ -12,17 +12,21 @@ import (
 
 // Manager of configs
 type Manager struct {
-	mu  utils.Mutex
-	log *zerolog.Logger
-	lp  *linkpearl.Linkpearl
+	mu            utils.Mutex
+	dkimPrivKey   string
+	dkimSignature string
+	log           *zerolog.Logger
+	lp            *linkpearl.Linkpearl
 }
 
 // New config manager
-func New(lp *linkpearl.Linkpearl, log *zerolog.Logger) *Manager {
+func New(lp *linkpearl.Linkpearl, log *zerolog.Logger, dkimPrivKey, dkimSignature string) *Manager {
 	m := &Manager{
-		mu:  utils.NewMutex(),
-		lp:  lp,
-		log: log,
+		mu:            utils.NewMutex(),
+		lp:            lp,
+		log:           log,
+		dkimPrivKey:   dkimPrivKey,
+		dkimSignature: dkimSignature,
 	}
 
 	return m
@@ -38,7 +42,11 @@ func (m *Manager) GetBot(ctx context.Context) Bot {
 	}
 	if config == nil {
 		config = make(Bot, 0)
-		return config
+	}
+
+	if config.DKIMPrivateKey() == "" {
+		config.Set(BotDKIMPrivateKey, m.dkimPrivKey)
+		config.Set(BotDKIMSignature, m.dkimSignature)
 	}
 
 	return config
diff --git a/internal/config/config.go b/internal/config/config.go
index 1066171..3886d44 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -21,11 +21,14 @@ func New() *Config {
 		Domains:      migrateDomains("domain", "domains"),
 		Port:         env.String("port", defaultConfig.Port),
 		Proxies:      env.Slice("proxies"),
-		NoEncryption: env.Bool("noencryption"),
-		DataSecret:   env.String("data.secret", defaultConfig.DataSecret),
-		MaxSize:      env.Int("maxsize", defaultConfig.MaxSize),
-		StatusMsg:    env.String("statusmsg", defaultConfig.StatusMsg),
-		Admins:       env.Slice("admins"),
+		DKIM: DKIM{
+			PrivKey:   env.String("dkim.privkey", defaultConfig.DKIM.PrivKey),
+			Signature: env.String("dkim.signature", defaultConfig.DKIM.Signature),
+		},
+		DataSecret: env.String("data.secret", defaultConfig.DataSecret),
+		MaxSize:    env.Int("maxsize", defaultConfig.MaxSize),
+		StatusMsg:  env.String("statusmsg", defaultConfig.StatusMsg),
+		Admins:     env.Slice("admins"),
 		Mailboxes: Mailboxes{
 			Reserved:   env.Slice("mailboxes.reserved"),
 			Forwarded:  env.Slice("mailboxes.forwarded"),
diff --git a/internal/config/types.go b/internal/config/types.go
index d8ed63f..e357213 100644
--- a/internal/config/types.go
+++ b/internal/config/types.go
@@ -22,8 +22,8 @@ type Config struct {
 	LogLevel string
 	// DataSecret is account data secret key (password) to encrypt all account data values
 	DataSecret string
-	// NoEncryption disabled encryption support
-	NoEncryption bool
+	// DKIM config
+	DKIM DKIM
 	// Prefix for commands
 	Prefix string
 	// MaxSize of an email (including attachments)
@@ -50,6 +50,12 @@ type Config struct {
 	Relay Relay
 }
 
+// DKIM config
+type DKIM struct {
+	PrivKey   string
+	Signature string
+}
+
 // DB config
 type DB struct {
 	// DSN is a database connection string