Setup OpenDKIM

EasyEngine (ee)

Install OpenDKIM:

apt-get install opendkim opendkim-tools

Additional packages will be listed as dependencies, type yes and press Enter to continue.

Configure OpenDKIM:

A couple of files must be created and edited in order to configure OpenDKIM.

Important: replace every instance of example.com with your own domain in all commands and configuration files. Don't forget to save your files after editing.

Let's start with the main configuration file:

vim /etc/opendkim.conf
ExternalIgnoreList      refile:/etc/opendkim/TrustedHosts
InternalHosts           refile:/etc/opendkim/TrustedHosts
KeyTable                refile:/etc/opendkim/KeyTable
SigningTable            refile:/etc/opendkim/SigningTable
SOCKET                  inet:8891@localhost

Next OpenDKIM defaults file:

vim /etc/default/opendkim
SOCKET="inet:8891@localhost"

Configure Postfix:

vim /etc/postfix/main.cf

# OpenDKIM
milter_default_action = accept
milter_protocol = 2
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891

OpenDKIM Directory Structure:

Create a directory structure that will hold the trusted hosts, key tables, signing tables and crypto keys:

mkdir -p /etc/opendkim/keys

Specify trusted hosts:

We will use this file to define both ExternalIgnoreList and InternalHosts, messages originating from these hosts, domains and IP addresses will be trusted and signed.

Because our main configuration file declares TrustedHosts as a regular expression file (refile), we can use wildcard patters, *.example.com means that messages coming from example.com's subdomains will be trusted too, not just the ones sent from the root domain.

Customize and add the following lines to the newly created file. Multiple domains can be specified, do not edit the first two lines:

vim /etc/opendkim/TrustedHosts
127.0.0.1
localhost

*.example.com

Create a key table:

A key table contains each selector/domain pair and the path to their private key. Any alphanumeric string can be used as a selector, in this example mail is used and it's not necessary to change it.

vim /etc/opendkim/KeyTable
mail._domainkey.example.com example.com:mail:/etc/opendkim/keys/example.com/mail.private

# mail._domainkey.example.net example.net:mail:/etc/opendkim/keys/example.net/mail.private
# mail._domainkey.example.org example.org:mail:/etc/opendkim/keys/example.org/mail.private

Create a signing table:

This file is used for declaring the domains/email addresses and their selectors.

vim /etc/opendkim/SigningTable
*@example.com mail._domainkey.example.com

# *@example.net mail._domainkey.example.net
# *@example.org mail._domainkey.example.org

Generate the public and private keys:

mkdir -p /etc/opendkim/keys/example.com
cd /etc/opendkim/keys/example.com
opendkim-genkey -s mail -d example.com

-s specifies the selector and -d the domain, this command will create two files, mail.private is our private key and mail.txt contains the public key.

Change the owner of the private key to opendkim:

chown opendkim:opendkim mail.private

Add the public key to the domain's DNS records

cat mail.txt

Copy that key and add a TXT record to your domain's DNS entries:

Name: mail._domainkey.example.com.
Text: "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5N3lnvvrYgPCRSoqn+awTpE+iGYcKBPpo8HHbcFfCIIV10Hwo4PhCoGZSaKVHOjDm4yefKXhQjM7iKzEPuBatE7O47hAx1CJpNuIdLxhILSbEmbMxJrJAG0HZVn8z6EAoOHZNaPHmK2h4UUrjOG8zA5BHfzJf7tGwI+K619fFUwIDAQAB"

Please note that the DNS changes may take a couple of hours to propagate.

Restart Postfix and OpenDKIM:

sudo service postfix restart
sudo service opendkim restart

Testing DKIM setup for correctness:

Anything we do, specially for first time, must end with successful testing! There are many tools for testing. I will mention few of them below.

1. Verify DNS Records for OpenDKIM Setup
2. Verify OpenDKIM Signing

Verify DNS Records for OpenDKIM Setup

dig mail._domainkey.example.com TXT
;; ANSWER SECTION:
mail._domainkey.exmaple.com. 86400 IN	TXT	"v=DKIM1\;" "k=rsa\;" "t=y\;" "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5N3lnvvrYgPCRSoqn+awTpE+iGYcKBPpo8HHbcFfCIIV10Hwo4PhCoGZSaKVHOjDm4yefKXhQjM7iKzEPuBatE7O47hAx1CJpNuIdLxhILSbEmbMxJrJAG0HZVn8z6EAoOHZNaPHmK2h4UUrjOG8zA5BHfzJf7tGwI+K619fFUwIDAQAB"

Webbase tool: http://www.protodave.com/tools/dkim-key-checker/ Use selector mail and domain example.com there.

Verify OpenDKIM Signing:

The configuration can be tested by sending an empty email to [email protected] or [email protected] and a reply will be received. If everything works correctly you should see DKIM check: pass under Summary of Results.

=========================================================
Summary of Results
==========================================================
SPF check:          pass
DomainKeys check:   neutral
DKIM check:         pass
Sender-ID check:    pass
SpamAssassin check: ham

Alternatively, you can send a message to a Gmail address that you control, view the received email's headers in your Gmail inbox, dkim=pass should be present in the Authentication-Results header field.

Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of [email protected] designates --- as permitted sender) [email protected];
       dkim=pass [email protected];

Test using swaks

apt-get install swaks
swaks -t [email protected] -f [email protected]