DomainKeys Identified Mail (DKIM)

[x] FILTER             OpenDKIM filter, requires libmilter/Sendmail

Configuration

The following configuration will allow signing of outgoing mail for the domain example.com using the mail selector (signing mail for multiple domains will not be detailed here).

Domain                  example.comDomain
KeyFile                 /var/db/dkim/mail.privatePrivate key location
Selector                mailSelector

On FreeBSD opendkim run by default as mailnull:mailnull (user/group) so for the unix socket creation it is necessary to use the directory /var/run/milteropendkim/ created by the startup script which has the necessary write permission for that user. It is always possible to use an inet socket with an associated IP address instead.

Socket                  local:/var/run/milteropendkim/sockMilter communication socket
UMask                   002

Signing key

Now the key is generated using the opendkim-genkey command, this will create 2 files, one with the private key, and one with a DNS record containing the public key. Generated files are named according to the chosen selector (here: mail): mail.private and mail.txt.

opendkim-genkey -b 2048 -s mailSelector -d example.comDomain

-b 2048 is asked for because opendkim-genkey still defaults to 1024, which its manual calls “the value recommended by the DKIM specification” — true of RFC 6376, and superseded by RFC 8301, which sets 1024 as the floor and 2048 as what a signer should prefer. The same RFC requires rsa-sha256 and forbids rsa-sha1; current OpenDKIM does that by default.

The -t flag this command used to carry marks the published key as being in test mode, which tells verifiers to treat a failed signature as though the message had not been signed at all. That is useful while setting DKIM up and pointless afterwards, and it was contradicted by this page's own record below, which carries no t=y. Add it back deliberately if you want a staged rollout, and take it out once the signatures verify.

The file mail.private must be moved to the location specified in the KeyFile entry of the opendkim.conf

mv mail.privateGenerated private key /var/db/dkim/mail.privatePrivate key location in opendkim.conf

The content of the mail.txt must be place in the DNS domain zone used for sending our email, this will look as follow:

mailSelector._domainkey IN      TXT     ( "v=DKIM1; k=rsa; "DKIM information
                                  "p=............" )Public key

Integration

Postfix

Now that DKIM is configured, will still need to indicate to our mail server that it needs to sign the outgoing mail, this is done by having our mail server talking to OpenDKIM through the milter protocol

# Milter
milter_default_action   = accept
smtpd_milters           = unix:/var/run/milteropendkim/sockOpenDKIM communication socket  # From smtpd daemon
non_smtpd_milters       = unix:/var/run/milteropendkim/sockOpenDKIM communication socket  # From submission

Due to the selected configuration, it is necessary to add the postfix user to the mailnull group to allow communication with the exported unix socket (umask: 002):

pw group mod mailnull -m postfix