DomainKeys Identified Mail (DKIM)

[x] FILTER             OpenDKIM filter, requires libmilter/Sendmail

Configuration

The following configuration will allow signing of outgoing mail for the domain example.com using the mail selector (signing mail for multiple domains will not be detailed here).

Domain                  example.comDomain
KeyFile                 /var/db/dkim/mail.privatePrivate key location
Selector                mailSelector

On FreeBSD opendkim run by default as mailnull:mailnull (user/group) so for the unix socket creation it is necessary to use the directory /var/run/milteropendkim/ created by the startup script which has the necessary write permission for that user. It is always possible to use an inet socket with an associated IP address instead.

Socket                  local:/var/run/milteropendkim/sockMilter communication socket
UMask                   002

Signing key

Now the key is generated using the opendkim-genkey command, this will create 2 files, one with the private key, and one with a DNS record containing the public key. Generated files are named according to the chosen selector (here: main): mail.private and main.txt.

opendkim-genkey -t -s mailSelector -d example.comDomain

The file main.private must be moved to the location specified in the KeyFile entry of the opendkim.conf

mv mail.privateGenerated private key /var/db/dkim/mail.privatePrivate key location in opendkim.conf

The content of the main.txt must be place in the DNS domain zone used for sending our email, this will look as follow:

mailSelector._domainkey IN      TXT     ( "v=DKIM1; k=rsa; "DKIM information
                                  "p=............" )Public key

Integration

Postfix

Now that DKIM is configured, will still need to indicate to our mail server that it needs to sign the outgoing mail, this is done by having our mail server talking to OpenDKIM through the milter protocol

# Milter
milter_default_action   = accept
smtpd_milters           = unix:/var/run/milteropendkim/sockOpenDKIM communication socket  # From smtpd daemon
non_smtpd_milters       = unix:/var/run/milteropendkim/sockOpenDKIM communication socket  # From submission

Due to the selected configuration, it is necessary to add the postfix user to the mailnull group to allow communication with the exported unix socket (umask: 002):

pw group mod mailnull -m postfix