When DKIM signing is configured, which DNS record must be updated to load the DKIM...

When DKIM (DomainKeys Identified Mail) signing is configured on Cisco ESA, the DNS record that must be updated to load the DKIM public signing key is the TXT record. The TXT record is used to store arbitrary text information in the DNS, such as the DKIM public key, which can be retrieved by the recipients to verify the DKIM signature in the message header.

References: User Guide for AsyncOS 15.0 for Cisco Secure Email Gateway, page 11-3.