If both the DKIM selector is set and a private certificate file is found which matches the email's "From" address domain in $CFG->dataroot/dkim/[domain]/[selector].private then the email will be signed. In most cases (for example if allowedemaildomains is empty) only a single certificate is needed in <pre>{$a->path}</pre>. For more setup details, see the documentation <a href="{$a->docs}">Mail configuration</a>.