Setup OpenDKIM

EasyEngine (ee)

Install OpenDKIM:

apt-get install opendkim opendkim-tools

Configure OpenDKIM:

Let's start with the main configuration file:

^_^[[email protected]:~]# vim /etc/opendkim.conf
ExternalIgnoreList      refile:/etc/opendkim/TrustedHosts
InternalHosts           refile:/etc/opendkim/TrustedHosts
KeyTable                refile:/etc/opendkim/KeyTable
SigningTable            refile:/etc/opendkim/SigningTable
SOCKET                  inet:8891@localhost

Next OpenDKIM defaults file:

^_^[[email protected]:~]# vim /etc/default/opendkim
SOCKET="inet:8891@localhost"

Configure Postfix:

^_^[[email protected]:~]# vim /etc/postfix/main.cf

# OpenDKIM
milter_default_action = accept
milter_protocol = 2
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891

Specify trusted hosts:

We will use this file to define both ExternalIgnoreList and InternalHosts, messages originating from these hosts, domains and IP addresses will be trusted and signed.

Because our main configuration file declares TrustedHosts as a regular expression file (refile), we can use wildcard patters, *.example.com means that messages coming from example.com's subdomains will be trusted too, not just the ones sent from the root domain.

Customize and add the following lines to the newly created file. Multiple domains can be specified, do not edit the first two lines:

^_^[[email protected]:~]# vim /etc/opendkim/TrustedHosts
127.0.0.1
localhost

*.example.com

Create a key table:

A key table contains each selector/domain pair and the path to their private key. Any alphanumeric string can be used as a selector, in this example mail is used and it's not necessary to change it.

^_^[[email protected]:~]# vim /etc/opendkim/KeyTable
mail._domainkey.example.com example.com:mail:/etc/opendkim/keys/example.com/mail.private

# mail._domainkey.example.net example.net:mail:/etc/opendkim/keys/example.net/mail.private
# mail._domainkey.example.org example.org:mail:/etc/opendkim/keys/example.org/mail.private

Create a signing table:

This file is used for declaring the domains/email addresses and their selectors.

^_^[[email protected]:~]# vim /etc/opendkim/SigningTable
*@example.com mail._domainkey.example.com

# *@example.net mail._domainkey.example.net
# *@example.org mail._domainkey.example.org

Generate the public and private keys:

Create a directory structure that will hold the trusted hosts, key tables, signing tables and crypto keys:

^_^[[email protected]:~]# mkdir -p /etc/opendkim/keys/example.com
^_^[[email protected]:~]# cd /etc/opendkim/keys/example.com
^_^[[email protected]:~]# opendkim-genkey -s mail -d example.com

-s specifies the selector and -d the domain, this command will create two files, mail.private is our private key and mail.txt contains the public key.

Change the owner of the private key to opendkim:

^_^[[email protected]:~]# chown opendkim:opendkim mail.private

Add the public key to the domain's DNS records

^_^[[email protected]:~]# cat mail.txt

Copy that key and add a TXT record to your domain's DNS entries:

Name: mail._domainkey.example.com.
Text: "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5N3lnvvrYgPCRSoqn+awTpE+iGYcKBPpo8HHbcFfCIIV10Hwo4PhCoGZSaKVHOjDm4yefKXhQjM7iKzEPuBatE7O47hAx1CJpNuIdLxhILSbEmbMxJrJAG0HZVn8z6EAoOHZNaPHmK2h4UUrjOG8zA5BHfzJf7tGwI+K619fFUwIDAQAB"

Please note that the DNS changes may take a couple of hours to propagate.

Restart Postfix and OpenDKIM:

^_^[[email protected]:~]# service postfix restart
^_^[[email protected]:~]# service opendkim restart

Testing DKIM setup for correctness:

Anything we do, specially for first time, must end with successful testing! There are many tools for testing. I will mention few of them below.

1. Verify DNS Records for OpenDKIM Setup
2. Verify OpenDKIM Signing
3. Test using swaks

Verify DNS Records for OpenDKIM Setup

dig mail._domainkey.example.com TXT
;; ANSWER SECTION:
mail._domainkey.exmaple.com. 86400 IN	TXT	"v=DKIM1\;" "k=rsa\;" "t=y\;" "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5N3lnvvrYgPCRSoqn+awTpE+iGYcKBPpo8HHbcFfCIIV10Hwo4PhCoGZSaKVHOjDm4yefKXhQjM7iKzEPuBatE7O47hAx1CJpNuIdLxhILSbEmbMxJrJAG0HZVn8z6EAoOHZNaPHmK2h4UUrjOG8zA5BHfzJf7tGwI+K619fFUwIDAQAB"

Webbase tool: http://www.protodave.com/tools/dkim-key-checker/ Use selector mail and domain example.com there.

Verify OpenDKIM Signing:

The configuration can be tested by sending an empty email to [email protected] or [email protected] and a reply will be received. If everything works correctly you should see DKIM check: pass under Summary of Results.

=========================================================
Summary of Results
==========================================================
SPF check:          pass
DomainKeys check:   neutral
DKIM check:         pass
Sender-ID check:    pass
SpamAssassin check: ham

Alternatively, you can send a message to a Gmail address that you control, view the received email's headers in your Gmail inbox, dkim=pass should be present in the Authentication-Results header field.

Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of [email protected] designates --- as permitted sender) [email protected];
       dkim=pass [email protected];

Test using swaks

apt-get install swaks
swaks -t [email protected] -f [email protected]