DKIM
DKIM
- DomainKeys Identified Mail
As always lets update the system first
aptitude update aptitude safe-upgrade
Now we need to install the DKIM filter, or as it’s called now OpenDKIM, for full specification take a look at their site.
aptitude install opendkim opendkim-tools
Now we need to create the necessary folders so OpenDKIM can work proplery
mkdir -pv /etc/opendkim/keys chown -Rv opendkim:opendkim /etc/opendkim chmod go-rwx /etc/opendkim/*
This will create the directory where we will hold the keys for OpenDKIM, after this step let’s take a look at how the process will look like, so we can create a script to automate this.
mkdir -p /etc/opendkim/keys/myserverplace.de cd /etc/opendkim/keys/myserverplace.de opendkim-genkey -d myserverplace.de -s mail chown -Rv opendkim:opendkim /etc/opendkim/keys/myserverplace.de chmod -v u=rw,go-rwx *
This easily understandble, what happens here.
Now you have two files /etc/opendkim/keys/myserverplace.de
ls -lah /etc/opendkim/keys/myserverplace.de total 16K drwxr-xr-x 2 opendkim opendkim 4.0K Oct 9 18:43 . drwxr-xr-x 5 opendkim opendkim 4.0K Oct 9 19:39 .. -rw------- 1 opendkim opendkim 887 Oct 9 18:43 mail.private -rw------- 1 opendkim opendkim 303 Oct 9 18:43 mail.txt* /etc/opendkim/keys/myserverplace.de/mail.private
contains the RSA PRIVATE KEY* /etc/opendkim/keys/myserverplace.de/mail.txt
Contains the record you need to add to your DNS zone
Next set is to setup the key tables, signing tables, and trusted hosts
First let’s prepare the files
touch /etc/opendkim/KeyTable touch /etc/opendkim/SigningTable touch /etc/opendkim/TrustedHosts* /etc/opendkim/TrustedHosts
needs to contain some data before we continue, so add the following information to this file, and adjust accordingly
127.0.0.1 localhost 144.76.163.46 144.76.163.57 ns1.myserverplace.de ns2.myserverplace.de myserverplace.deSo let’s see what does what:* /etc/opendkim/KeyTable
KeyID Domain:Selector:PathToPrivateKey* /etc/opendkim/SigningTable
- The filter used is programmed to read the table by looking for matched domain
- /etc/opendkim/TrustedHosts
It will list the top trusted hosts as you desire
Those three files contain all the necessary information for the signing to work.
So in my case for my domain I do.
echo "myserverplace.de myserverplace.de:mail:/etc/opendkim/keys/myserverplace.de/mail.private" >> /etc/opendkim/KeyTable echo "*@myserverplace.de myserverplace.de" >> /etc/opendkim/SigningTable echo "myserverplace.de" >> /etc/opendkim/TrustedHosts echo "mail.myserverplace.de" >> /etc/opendkim/TrustedHosts
So let’s put all this together in a script so we don’t have to do it all the time
#!/bin/bash
# /opt/generatedkim.sh
die () {
echo >&2 "$@"
exit 1
}
[ "$#" -eq 1 ] || die "1 argument required, $# provided, domain required, ex: ./script example.com"
cwd=`pwd` opendkim="/etc/opendkim" location="$opendkim/keys/$1" [ -d "$location" ] && die "There is already a directory in the folder, delete the folder if you want to create a new one"
mkdir -p "$location" cd "$location" opendkim-genkey -d $1 -s mail chown opendkim:opendkim * chown opendkim:opendkim "$location" chmod u=rw,go-rwx * echo "$1 $1:mail:$location/mail.private" >> "$opendkim/KeyTable" echo "*@$1 $1" >> "$opendkim/SigningTable" echo "$1" >> "$opendkim/TrustedHosts" echo "mail.$1" >> "$opendkim/TrustedHosts" echo echo "Put this in the DNS ZONE for domain: $1" echo cat "$location/mail.txt" echo cd "$cwd"
So if we run the script, we should get output like this, and this is the data we need to put in the DNS zone.
/opt/generatedkim.sh test.de
Put this in the DNS ZONE for domain: test.de
mail._domainkey IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPzE0GmvFwAQsgcFzopy4zMNWUbL6JM5XIyjBy3bUnANI5axeb/Lw/GBjUoSFLEiO80Tt8m3A5YrBKcodRQQURYiW6/YtElhLupHyfcxQhfNLU4z9JUOJKPjcpMZCj0Xv873QgVOl+7U605JdBHSPOx4ybBZwDq68cw9YFYRPmEwIDAQAB" ; ----- DKIM key mail for test.de
Unfortunatly I don’t have time to create a script to do this automatically, you can always insert a record in MySQL database so it’s in the ZONE and you can regenerate the DNS Zone from the command line, and I won’t be having a lot of domains, so I can add this entry manually to a domain I want DKIM enabled
Let’s open the domain and go to DNS Settings, and you can click ** Add Resource **
You popuplate the following data in the inputboxes* Record type
TXT* Domain name
mail._domainkey* TXT Record
In the text record you copy a part of the contents from the file /etc/opendkim/keys/myserverplace.de/mail.txt, it data should start from v=DKIM1; k=rsa; to the end, without the quotes as you can see it’s in quotes.
In the example above for domain test.de you add only the following contents in the input box
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPzE0GmvFwAQsgcFzopy4zMNWUbL6JM5XIyjBy3bUnANI5axeb/Lw/GBjUoSFLEiO80Tt8m3A5YrBKcodRQQURYiW6/YtElhLupHyfcxQhfNLU4z9JUOJKPjcpMZCj0Xv873QgVOl+7U605JdBHSPOx4ybBZwDq68cw9YFYRPmEwIDAQAB
Well that’s it for this, now let’s check with dig if the record is there
dig mail._domainkey.myserverplace.de TXT @ns1.myserverplace.de
You will see in the Answer section I have the following entry
mail._domainkey.myserverplace.de. 600 IN TXT "v=DKIM1\; k=rsa\; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMziMcgPTWK0kSUKxrgHHzEiWxNkZ2/M0Ugyr/8H9WtoCsJUM+Bc1C9VwqJ6yjTidecDrX7aL0lFZ9Mylku/wtSiPw6KLxMg2LG2vrMzlPTB2lmJNmg/EOu3KPC8BtAuOhXfwVH/ttQbzdKJKWqiCJn7jhF5oqEKnOCORxOQXKIwIDAQAB"
Well everything is setup up at least from the DNS side, now we need to configure Postfix to use this data and sign the emails.
You can also use the following URLs to check the validity of your key* dkim-key-checker
In the selector fields try with both mail, and default, you shold be getting valid results
OpenDKIM
We need to edit the configuration file to configure DKIM, open /etc/opendkim.conf with your favorite editor and add the following lines to the end of the file
# Enable Logging Syslog yes SyslogSuccess yes LogWhy yes # User mask UMask 002 # Always oversign From (sign using actual From and a null From to prevent malicious signatures header fields (From and/or others) between the signer and the verifier) OversignHeaders From # Our KeyTable and SigningTable KeyTable refile:/etc/opendkim/KeyTable SigningTable refile:/etc/opendkim/SigningTable # Trusted Hosts ExternalIgnoreList /etc/opendkim/TrustedHosts InternalHosts /etc/opendkim/TrustedHosts # Hashing Algorithm SignatureAlgorithm rsa-sha256 # Auto restart when the failure occurs. CAUTION: This may cause a tight fork loops AutoRestart Yes # Set the user and group to opendkim user UserID opendkim:opendkim # Specify the working socket Socket inet:8891@localhost
That’s it for OpenDKIM, now we should restart the service
service opendkim restart