C# | jstedfast/MimeKit | Office 365 connector with DKIM setup

DKIM is set up for a domain in Office365. A .Net application (currently MVC 4) sends Email through an O365 connector to external parties. We'd like to sign these using DKIM as well.

I'm not quite clear about the entire process. MimeKit's Documentation is reasonably clear. I suppose I can use any pub/priv key generator such as Putty to generate a keypair? I would then store the private key in a way that the C# application can read it into

var signer = new DkimSigner ("privatekey.pem") {
   SignatureAlgorithm = DkimSignatureAlgorithm.RsaSha1,
   AgentOrUserIdentifier = "@eng.example.com",
   QueryMethod = "dns/txt",
};

The public key will be published as a DNS record for my domain. Unfortunately, the Office 365 documentation isn't all too clear on the exact how.

Summary Questions

What exactly goes into AgentOrUserIdentifier, if my system sends with the address application@example.org?
How exactly would I publish my generated public key to Office 365?

Any enlightening summary would be greatly appreciated, thanks.

Solution

From rfc6376, section 2.6:

2.6. Agent or User Identifier (AUID)

A single identifier that refers to the agent or user on behalf of whom the Signing Domain Identifier (SDID) has taken responsibility. The AUID comprises a domain name and an optional <local-part>. The domain name is the same as that used for the SDID or is a subdomain of it. For DKIM processing, the domain name portion of the AUID has only basic domain name semantics; any possible owner-specific semantics are outside the scope of DKIM. It is specified in Section 3.5.

Note that acceptable values for the AUID may be constrained via a flag in the public-key record. (See Section 3.6.1.)