I am running a postfix mail server, and want to sign all outgoing emails with a DKIM key.

I have it configured and working for webmail, and mail sent from the server itself. However users not using webmail but an email client such as thunderbird do not have their outgoing emails signed.

I am pretty certain that I need to use internalhosts to tell opendkim to sign certain hosts that do not originate internally.

The problem I have is that I do not know where these users will be connecting from. So what I do I need to do to ensure that emails are signed no matter where a user is connecting from?