User:Paul/sandbox/Install DKIM

WARNING: This article is in a user sandbox, indicating it is a rough draft, and as such, is likely incomplete, contains buggy and insecure configurations, and is subject to substantial and frequent changes.

This article explains how to set up DomainKeys Identified Mail (DKIM) with the  package on a UNPM server. This is part of a series of articles explaining how to set up a mail server. Most of the commands in this article require  privilege:

username@servername:~$ sudo -i

Install DKIM
Install  and its associated tools package, create a key directory, and create a server key:

root@servername:~# aptitude install opendkim opendkim-tools root@servername:~# mkdir -p /etc/opendkim/keys/example.com root@servername:~# opendkim-genkey -r -b 2048 -h sha256 -d mail.example.com -s selector -D /etc/opendkim/keys/example.com

Replace  desired, as it is only used to identify the key the server will call. Many admins will simply use the date the key was created (e.g. '20140510') or, when multiple servers are being used, the server name (e.g. 'mta05'), though none of this is standardized or required - some simply use 'mail', or don't specify anything when running the command, leaving the selector of 'default'. The command creates two files,  and. The  file contains the private key while   contains the basis for the DNS TXT record that will be created in a later step.

Note that the DKIM standard currently recommends a maximum key size of 2048 bits, so using a larger key size will likely cause the DKIM test to fail on many servers, while using a key smaller 1024 bits is not only not recommended, but has been demonstrated to be insecure.

Create the tables that  will use:

root@servername:~# nano /etc/opendkim/KeyTable

Add: mail.example.com mail.example.com:selector:/etc/opendkim/keys/example.com/selector.private

Since this server is being configured to have one domain serve mail for multiple domains, only one private key is being used.

root@servername:~# nano /etc/opendkim/SigningTable

Add: *@example.com mail.example.com *@subdomain.example.com mail.example.com *@example.org mail.example.com

The second and third entries demonstrate how additional domains served by the mail server would be added to the signing table. Note that  does not currently support signing for subdomains and would have to be modified to support such.

root@servername:~# nano /etc/opendkim/TrustedHosts

127.0.0.1 localhost mail.example.com

Set permissions on the directory, archive the default  before creating a new one:

root@servername:~# chown -R opendkim:opendkim /etc/opendkim root@servername:~# mv /etc/opendkim.conf /etc/original.opendkim.conf root@servername:~# nano /etc/opendkim.conf

Add to the new file: Syslog                 yes UMask                  002 SubDomains             no AutoRestart             yes Background             yes Canonicalization       relaxed/relaxed DNSTimeout             5 Mode                   sv SignatureAlgorithm      rsa-sha256 ExternalIgnoreList     refile:/etc/opendkim/TrustedHosts InternalHosts          refile:/etc/opendkim/TrustedHosts KeyTable               refile:/etc/opendkim/KeyTable SigningTable           refile:/etc/opendkim/SigningTable LogWhy                 Yes PidFile                /var/run/opendkim/opendkim.pid Socket                 local:/var/spool/postfix/opendkim/opendkim.sock SyslogSuccess          Yes TemporaryDirectory     /var/tmp UserID                 opendkim:opendkim OversignHeaders        From
 * 1) This is a basic configuration that can easily be adapted to suit a standard
 * 2) installation. For more advanced options, see opendkim.conf(5) and/or
 * 3) /usr/share/doc/opendkim/examples/opendkim.conf.sample.
 * 1) Log to syslog
 * 1) Required to use local socket with MTAs that access the socket as a non-
 * 2) privileged user (e.g. Postfix)
 * 1) Commonly-used options
 * 1) Additional OpenDKIM options
 * 1) Always oversign From (sign using actual From and a null From to prevent
 * 2) malicious signatures header fields (From and/or others) between the signer
 * 3) and the verifier.  From is oversigned by default in the Debian package
 * 4) because it is often the identity key used by reputation systems and thus
 * 5) somewhat security sensitive.

Though most of the settings are fairly self-explanatory, it is a good idea to become familiar with the various settings to reduce the time spent troubleshooting why other mail servers are failing DKIM checks on mail sent from the server. One particular setting to note is  (everything after the @ symbol in an email address) being set to.

Create the directory for the domain socket specified in, make the   user a member of the   group so it can edit  , and restart the service:

root@servername:~# mkdir /var/spool/postfix/opendkim root@servername:~# chown opendkim:root /var/spool/postfix/opendkim root@servername:~# service opendkim restart

DKIM DNS TXT record
DKIM can only function with a valid DNS TXT record. In the DNS manager for your DNS server, make the following new TXT record:

Enter into the optional subdomain field: selector._domainkey

Enter the contents of  into the body of the record using the format below (i.e. only the contents between   and  ):

v=DKIM1; h=sha256; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuX4vPnLopTAIMFnnuP4CCEfE/FtQO0mi77voGsWSvHQfvFMIkQ3W3VmeAEiSJd6SVkL/Ojr30ag2i6wA3NTU+1ndfgL371zKx4gDAnewoRA4N2P05HPUNe10DE+m4xnwB6zsQnnPJ3EgKIW6W/v+fN/EzTfeJo5UmxiAoFRIq5hgyeHHCI8aKMQLCmWhb/Pz22MiqRHxV91xmTMLx/e3BIsplcOmQjlOyGagoIZJxpcTlf9OiSWks2a5kHXEN40eh99zkPGInqTrbhDog+cn/mvPgY0uIznx1i/ubRQFtYaH5t6vCu5uSMEQjcTQnWRLI9Qt7Mp15hOMrpkKv4SPzwIDAQAB

Keys can be verified using tools such as the one at DKIM Core. Some DNS servers may not like the length of the key string, so it may be necessary to use one of the record formatting methods recommended in the OpenDKIM README.

Next step
Install DMARC.