OpenDKIM + Postfix = just

At the end of 2011, the developers of the dkim-milter project discontinued its support and development. Fortunately, OpenDKIM came to replace the dkim-milter project , with which it’s just as easy to add a DKIM signature to the letters.


')

Instructions for configuring Postfix and OpenDKIM

To do this, we need Postfix itself and the OpenDKIM packages. Install all necessary components using your batch manager:

aptitude install opendkim opendkim-tools 

Now we need to get the keys that we will use to sign letters.

Signature keys

We will get the key for the server domain and for the selector, equal to the name of the server without a domain, so as not to invent anything:

 mkdir /etc/opendkim/ opendkim-genkey -D /etc/opendkim/ -d $(hostname -d) -s $(hostname) 

If it happens on the mail.example.com server, then the last command will create the /etc/opendkim/mail.private and /etc/opendkim/mail.txt , with private and public keys, respectively. The public key must be added to the appropriate TXT record of your domain.

The key files must be given read access to the group in which OpenDKIM is running, and postfix itself postfix added to the same group so that it can sign letters connecting to the OpenDKIM daemon through its socket:

 chgrp opendkim /etc/opendkim/* chmod g+r /etc/opendkim/* gpasswd -a postfix opendkim 

Where to find the keys?

/etc/opendkim.conf /etc/opendkim.conf and add our settings:

 tee -a /etc/opendkim.conf <<EOF Canonicalization relaxed/relaxed SyslogSuccess yes KeyTable file:/etc/opendkim/keytable SigningTable file:/etc/opendkim/signingtable X-Header yes #      : LogWhy yes #       : #ExternalIgnoreList file:/etc/opendkim/trusted #   ,    : #InternalHosts file:/etc/opendkim/internal EOF 

A detailed description of all directives is available in the documentation.

What keys to sign?

The list of available keys will be /etc/opendkim/keytable in the /etc/opendkim/keytable in the format " ::/// ". If you created the keys with the command above, then you can register the key according to the FQDN of the server in this file as follows:

 echo $(hostname -f | sed s/\\./._domainkey./) $(hostname -d):$(hostname):$(ls /etc/opendkim/*.private) | tee -a /etc/opendkim/keytable 

For mail.example.com there will be the following line in the file:

 mail._domainkey.example.com example.com:mail:/etc/opendkim/mail.private 

There can be any number of keys in this file for any number of domains. Also, keys can be stored in the database - in more detail in the documentation.

Whose mail to sign?

Now let us explain OpenDKIM mail of which domains with which keys to sign in the /etc/opendkim/signingtable in the format " - ":

 echo $(hostname -d) $(hostname -f | sed s/\\./._domainkey./) | tee -a /etc/opendkim/signingtable 

For the mail.example.com host, the file will be example.com mail._domainkey.example.com . If you want to sign all outgoing mail at all, you can specify * instead of a domain.

Other files specified in the ExternalIgnoreList and InternalHosts directives contain simply a list of hosts and / or IP addresses each on a new line, the signatures of letters for which will either be ignored or added. If your mail is answered by a single server, then you don’t need to do anything with them.

Configure Postfix

Finally, we ask Postfix to send all the letters for signature:

 postconf -e milter_default_action=accept postconf -e milter_protocol=2 postconf -e smtpd_milters=unix:/var/run/opendkim/opendkim.sock postconf -e non_smtpd_milters=unix:/var/run/opendkim/opendkim.sock 

If Postfix is ​​in chroot ...

If you use Postfix without chroot, then nothing else needs to be done to configure it. Otherwise, most likely, you need to explain to OpenDKIM where it should create a socket and give appropriate rights for everything:

 echo 'SOCKET="local:/var/spool/postfix/var/run/opendkim/opendkim.sock"' | tee -a /etc/default/opendkim mkdir -p /var/spool/postfix/var/run/opendkim chown opendkim:opendkim /var/spool/postfix/var/run/opendkim 

Done!

We restart Postfix and OpenDKIM using standard tools, send a test letter somewhere to Yandex , and enjoy the successful result of the signature verification:



Do not forget to add a TXT record and check that it is in place:

 dig txt mail._domainkey.example.com 

Another way to verify the signature is to send an email to check-auth@verifier.port25.com .

We will forbid letters without signature

If the check was successful, then it is necessary to formally prohibit other servers to receive letters with your domain, but without a signature, by adding the ADSP entry :

 _adsp._domainkey IN TXT "dkim=all" 

the end

Read to the end, but want more? Much shorter instructions on how to configure OpenDKIM with one domain and correctly configured hostname.