DomainKeys Identified Mail (DKIM)
Lets an organization take responsibility for a message that is in transit. The organization is a handler of the message, either as its originator or as an intermediary. Their reputation is the basis for evaluating whether to trust the message for further handling, such as delivery. Technically DKIM provides a method for validating a domain name identity that is associated with a message through cryptographic authentication.In essence, it will help you to avoid going your mail into spam. Follow each steps remember to change example.com with your domain.
And selector with your selector(ie, any text).
1.Login to root and install opendkim
sudo su sudo apt-get install opendkim opendkim-tools
2.Making directory and generating keys
mkdir /etc/opendkim/ cd /etc/opendkim
-d means domain so change the word after it as our need,here example.com
opendkim-genkey -s selector -d example.com
thus two files selector.txt selector.private are created
3.Adding user and making appropriate permissions
To check user a user ‘opendkim’ exists or notgrep opendkim /etc/passwdNow run this also
chmod 700 /var/run/opendkimIf user is not already there we have to add the user
useradd -r -g opendkim -G mail -s /sbin/nologin -d /var/run/opendkim -c "OpenDKIM" opendkimChange ownership to opendkim
chown opendkim:opendkim selector.privateTo check the ownership of any file use also may use
ls -la /etc/opendkim | grep selector
4.Publishing DNS Record
cat selector.txtOn typing above command, you get a result like this
selector._domainkey IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5N3lnvvrYgPCRSoqn+awTpE+iGYcKBabe8HHbcFfCIIVty76o4PhCoGZSaKVHOjDm4yefKXhQjM7iKzEPuBatE7O47hAx1CJpNuIdLxhILSbEmbMxJrJAG0HZVn8z6EAoOHZNaPHmK2h4UUrjOG8zA5BHfzJf7tGwI+K619fFUwIDAQAB" ; ----- DKIM key mail for example.comAdd TXT record from your hosting websites (for example, digitalocean’s) control panel. A
selector._domainkey. In our case, copy
selector._domainkeyin name field copy the text included in “” (including “) to text field from above result. A selector mail is shown in example given below
To check the status of dns // or you can use http://dkimcore.org/tools/
dig selector._domainkey.example.com txt +shortTest the key with server
opendkim-testkey -d example.com -s selector -k selector.private -vvv
5.Edit the OpenDKIM configuration file
cp /etc/opendkim.conf /etc/opendkim.conf.bk nano /etc/opendkim.conf cat /etc/opendkim.conf On entering above command you can see my configuratoin of opendkim, # is used to comment
# Log to syslog Syslog yes # Required to use local socket with MTAs that access the socket as a non- # privileged user (e.g. Postfix) UMask 022 # Sign for example.com with key in /etc/mail/dkim.key using # selector '2007' (e.g. 2007._domainkey.example.com) #Domain example.com #KeyFile /etc/opendkim/key1.private #Selector key1 # Commonly-used options; the commented-out versions show the defaults. Canonicalization relaxed/simple Mode sv #s sign v verify SubDomains yes #ADSPDiscard no # Log to syslog Syslog yes SyslogSuccess yes LogWhy yes # Required to use local socket with MTAs that access the socket as a non- # privileged user (e.g. Postfix) UMask 022 UserID opendkim:opendkim # KeyTable /etc/opendkim/key SigningTable refile:/etc/opendkim/sign ExternalIgnoreList refile:/etc/opendkim/TrustedHosts InternalHosts refile:/etc/opendkim/TrustedHosts # Hashing Algorithm SignatureAlgorithm rsa-sha256 # Socket inet:8891@localhost # Always oversign From (sign using actual From and a null From to prevent # malicious signatures header fields (From and/or others) between the signer # and the verifier. From is oversigned by default in the Debian pacakge # because it is often the identity key used by reputation systems and thus # somewhat security sensitive. OversignHeaders From # List domains to use for RFC 6541 DKIM Authorized Third-Party Signatures # (ATPS) (experimental)
5.Working with text files (TrustedHosts,SigningTable,KeyTable)
Edit /etc/default/opendkim: Uncomment this row and use port 8891:SOCKET="inet:8891@localhost" # listen on loopback on port
To allow connection through firewall
sudo iptables -A INPUT -i lo -j ACCEPT
Now create a file
nano /etc/opendkim/key
And add the line
selector._domainkey.example.com example.com:selector:/etc/opendkim/selector.private
Create another file
nano /etc/opendkim/TrustedHosts
And add the following lines
127.0.0.1 localhost example.com *.example.com 123.123.123.123 #(IP address of your server, if applicable)
Create another file
nano /etc/opendkim/sign
And add the following line at end
*@example.com selector._domainkey.example.com
Take a backup of postfix configuration file, which may be useful incase any errors.
cp /etc/postfix/main.cf /etc/postfix/main.cf.bk
Edit /etc/postfix/main.cf and add the lines to the end
nano /etc/postfix/main.cf milter_default_action = accept milter_protocol = 2 smtpd_milters=inet:localhost:8891 non_smtpd_milters=inet:localhost:8891
6.Restart opendkim and postfix
service opendkim restart service postfix restar #also use service postfix status to check the status
Logs
#you can look at logs, THIS HIGHLY USEFULvim /var/log/mail.log vim /var/log/mail.err
Now if we want many domains
Do replace example.com and selector for each domainsWhat we have to do is to
1. generate one more key
sudo su cd /etc/opendkim opendkim-genkey -s [selector] -d example.com # replace both [selector] and example.com with new selector and domain name2. Change permission of generated key file
chown opendkim:opendkim [selector].private #[selector] we used in above step3.add the details in TrustedHosts,SigningTable,KeyTable
Create the file
nano /etc/opendkim/keyAnd add the following line at end
[selector]._domainkey.example.com example.com:[selector]:/etc/opendkim/[selector].privateCreate the file
nano /etc/opendkim/signAnd add the following line
*@example.com [selector]._domainkey.domain.comCreate the file
nano /etc/TrustedHostsAnd add the following line
*.domain.com domain.comAlso remember to restart opendkim and postfix each time.
service opendkim restart sevice postfix restartFinally send
or http://www.brandonchecketts.com/emailtest.php
or use http://www.mail-tester.com
to check the status of DKIM Signing by sending mails to these.
Reference
http://askubuntu.com/questions/134725/setup-dkim-domainkeys-for-ubuntu-postfix-and-mailman(i started with this, then followed his reference )
http://stevejenkins.com/blog/2010/09/how-to-get-dkim-domainkeys-identified-mail-working-on-centos-5-5-and-postfix-using-opendkim/
(I think the best tutorial but on centos)
http://www.cioby.ro/linux/configuring-opendkim-to-sign-postfix-emails.html
http://linuxaria.com/howto/using-opendkim-to-sign-postfix-mails-on-debian
https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-dkim-with-postfix-on-debian-wheezy
(TXT related portion is misleading)