Setting up an outbound DKIM provider

Warning

This one is not trivial at all. We faced two major problems to set it up:

Install

see dkim-install.

The trick we need

we need to add postfix to the opendkim group (and not the other way around).

usermod -aG opendkim postfix
grep ^opendkim /etc/group # postfix should be there
grep ^postfix /etc/group # nope

also a shared path between chroot and non-chroot postfix processes

mkdir -p /var/spool/postfix/run/opendkim/

chown -R opendkim. /run/opendkim/
chmod 770 /run/opendkim/

chown -R opendkim. /var/spool/postfix/run/opendkim/
chmod 770 /var/spool/postfix/run/opendkim/

systemctl stop opendkim
# we will do that later on
#ln -s /var/spool/postfix/run/opendkim/opendkim.sock /run/opendkim/opendkim.sock
#chown -h opendkim. /run/opendkim/opendkim.sock

ls -alF /run/opendkim/ # owned by opendkim:opendkim but the pid
ls -alF /var/spool/postfix/run/opendkim/ # owned by opendkim:opendkim

Key-pair and DNS record

the selector can be anything, it is just a marker e.g. use month/year to remind yourself how old the key pair will become (and eventually renew it once a year or so)

domain=DOMAIN.TLD

MONTHYEAR=`date +%b%Y | tr A-Z a-z`
echo $MONTHYEAR

# debian defaults
mkdir -p /etc/dkimkeys/
chmod 700 /etc/dkimkeys/
cd /etc/dkimkeys/

opendkim-genkey -h
opendkim-genkey --selector=$MONTHYEAR --domain=$domain
chown opendkim. $MONTHYEAR.*
chmod 400 $MONTHYEAR.*
cat $MONTHYEAR.txt

add this record to your zone and check

host -t txt $MONTHYEAR._domainkey.$domain

Setup

ls -lF /usr/share/dns/root.key
mv -i /etc/opendkim.conf /etc/opendkim.conf.dist
# /usr/pkg/etc/opendkim.conf
grep -vE '^[[:space:]]*#|^[[:space:]]*$' /etc/opendkim.conf.dist > /etc/opendkim.conf.clean
grep -vE '^[[:space:]]*#|^[[:space:]]*$' /etc/opendkim.conf.dist > /etc/opendkim.conf

echo $domain
echo $MONTHYEAR
cat > /etc/opendkim.conf <<EOF

Syslog                  yes
SyslogSuccess           yes
Canonicalization        relaxed/simple
OversignHeaders         From
UserID                  opendkim
UMask                   007
TrustAnchorFile         /usr/share/dns/root.key

Socket                  local:/var/spool/postfix/run//opendkim/opendkim.sock
PidFile                 /run/opendkim/opendkim.pid

Mode            sv
Domain                  $domain
KeyFile                 /etc/dkimkeys/$MONTHYEAR.private
Selector                $MONTHYEAR
Statistics              /run/opendkim/stats

EOF

more options

#SignatureAlgorithm rsa-sha256
#SignatureAlgorithm rsa-sha1
#AllowSHA1Only      Yes

Postfix setup

the default action here is “let the mail pass through” in case “application is unavailable or mis-configured”

    ls -lF /run/opendkim/opendkim.sock
    vi /etc/postfix/main.cf

    milter_default_action = accept
    smtpd_milters = unix:/run/opendkim/opendkim.sock
    non_smtpd_milters = unix:/run/opendkim/opendkim.sock

no need to downgrade

    #milter_protocol = 2

and in case there is some group permission issue, eventually restart Postfix instead of a simple reload.

Ready to go

debian

systemctl restart opendkim
systemctl status opendkim # already enabled

ln -s /var/spool/postfix/run/opendkim/opendkim.sock /run/opendkim/opendkim.sock
chown -h opendkim. /run/opendkim/opendkim.sock

from source

start & enable

vi /etc/rc.local

echo -n opendkim...
rm -f /run/opendkim/opendkim.pid
/usr/local/sbin/opendkim -x /etc/opendkim.conf && echo done || echo FAIL
# -P -l -u

status

pgrep -a opendkim
ps auxww | grep opendkim
cat /run/opendkim/opendkim.pid
ls -lF /run/opendkim/opendkim.sock

stop

pkill opendkim

Postfix

See the DKIM section from the Postfix guide.

Operations

eventually enable that as a weekly cron job

opendkim-stats /run/opendkim/stats

Acceptance

outgoing

now send a mail from an SASL-capable MUA. then watch the logs and look for DKIM-Signature header in the resulting message’s source.

you can also send a message to dkim validator

incoming

TODO - check that wrongly signed incoming messages are refused

Troubleshooting

warning: connect to Milter service unix:/run/opendkim/opendkim.sock: No such file or directory

==> don’t forget to regenerate the symlink (see above)

compilation time issues

#39 Impossible to install OpenDkim : milter not found https://sourceforge.net/p/opendkim/support-requests/39/?limit=25

#9 ./configure –without-milter –disable-filter doesn’t work https://sourceforge.net/p/opendkim/bugs/9/

OpenSSL missing during ./configure. How to fix? https://superuser.com/questions/371901/openssl-missing-during-configure-how-to-fix

shared object

ld: /usr/local/ssl/lib/libcrypto.a(ecp_mont.o): relocation R_X86_64_32 against `.rodata.str1.1' can not be used when making a shared object; recompile with -fPIC
...

==> --disable-shared

unix socket perms

postfix/cleanup[15894]: warning: connect to Milter service unix:/var/opendkim/dkim-socket: Permission denied

==> several issues need to be considered but in short, postfix needs write access to the socket

Postfix - Opendkim - Unable to connect to local socket https://serverfault.com/questions/724584/postfix-opendkim-unable-to-connect-to-local-socket

postfix/smtpd: warning: connect to Milter service unix:/var/run/opendkim/opendkim.sock: No such file or directory https://unix.stackexchange.com/questions/74477/postfix-smtpd-warning-connect-to-milter-service-unix-var-run-opendkim-opendki

oh and the other way around, when opendkim got added to postfix group

postfix/sasl/smtpd[1809]: warning: connect to Milter service unix:/var/opendkim/dkim-socket: Permission denied

==> 770 / 660

Resources

dkim-milter https://sourceforge.net/projects/dkim-milter/

DomainKeys Identified Mail (DKIM) http://dkim.org/

OpenDKIM http://opendkim.org/

DKIM http://silas.net.br/tech/apps/netbsd-mailserver.html#dkim

Postfix before-queue Milter support http://www.postfix.org/MILTER_README.html

Postfix Configuration Parameters http://www.postfix.org/postconf.5.html

Configure DomainKeys (OpenDKIM) with Postfix on CentOS 7 https://www.linuxtechi.com/configure-domainkeys-with-postfix-on-centos-7/

Set Up DKIM (DomainKeys Identified Mail) Working With Postfix On CentOS Using OpenDKIM - Page 2 https://www.howtoforge.com/set-up-dkim-domainkeys-identified-mail-working-with-postfix-on-centos-using-opendkim-p2#-testing-your-setup

Configure SPF and DKIM With Postfix on Debian 8 https://www.linode.com/docs/email/postfix/configure-spf-and-dkim-in-postfix-on-debian-8/

Part 4: How to Set up SPF and DKIM with Postfix on Ubuntu Server https://www.linuxbabe.com/mail-server/setting-up-dkim-and-spf

5 common mistakes to avoid when deploying DMARC https://www.dmarcanalyzer.com/common-mistakes-deploying-dmarc/

Understanding the SPF and DKIM Spam Filtering Mechanisms https://securityintelligence.com/understanding-the-spf-and-dkim-spam-filtering-mechanisms/

opendkim https://wiki.debian.org/opendkim

received

Postfix before-queue Milter support http://postfix.cs.utah.edu/MILTER_README.html –> warning about header_checks(5)

Postfix header_check cause dkim fail. https://takahisa.info/2020/09/10/postfix-header_check-cause-dkim-fail/

DKIM signing emails using Postfix with removed headers https://stackoverflow.com/questions/20151999/dkim-signing-emails-using-postfix-with-removed-headers

misc

opendkim-stats - output opendkim statistics http://www.huge-man-linux.net/man8/opendkim-stats.html

alternatives

Chapter 56 - Support for DKIM (DomainKeys Identified Mail) http://exim.org/exim-html-4.85/doc/html/spec_html/ch-support_for_dkim_domainkeys_identified_mail.html

Mail-DKIM and DKIMproxy http://dkimproxy.sourceforge.net/

https://unix.stackexchange.com/questions/74477/postfix-smtpd-warning-connect-to-milter-service-unix-var-run-opendkim-opendki

https://serverfault.com/questions/796742/connect-to-milter-service-unix-var-run-opendkim-opendkim-sock-no-such-file-or


HOME | GUIDES | LECTURES | LAB | SMTP HEALTH | HTML5 | CONTACT
Copyright © 2024 Pierre-Philipp Braun