3.8 KiB
Hi,
Please note that :
This is the revision 2 of this Work In Progress How-To
Until this is natively integrated in YnH core apps, it will mean to that postfix conf will be blocked (or each time there is a change some configuration lines will need to be added to the end of /etc/postfix/main.cf)
To be fully functionnal DKIM requires a modification of the DNS, which propagantion can take up to 24h
CREDIT : This tutorial has been initially based on the DKMI section of : http://sealedabstract.com/code/nsa-proof-your-e-mail-in-2-hours/ from Drew Crawford
CREDIT : This tutorial has been reviewed based on https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-dkim-with-postfix-on-debian-wheezy from Popute Sebastian Armin
Replace DOMAIN.TLD by your own domain name
Changes in rev 2 :
Much easier to manage more than one DOMAIN.TLD (future proof)
Updated configuration as it seemed that the previous one was based on old software
So, here is the thing :
We start by installing the right software :
sudo aptitude install opendkim opendkim-tools
Then we configure opendkim
sudo nano /etc/opendkim.conf (Text to be placed in the text file: )
AutoRestart Yes AutoRestartRate 10/1h UMask 022 Syslog yes SyslogSuccess Yes LogWhy Yes
Canonicalization relaxed/simple
ExternalIgnoreList refile:/etc/opendkim/TrustedHosts InternalHosts refile:/etc/opendkim/TrustedHosts KeyTable refile:/etc/opendkim/KeyTable SigningTable refile:/etc/opendkim/SigningTable
Mode sv PidFile /var/run/opendkim/opendkim.pid SignatureAlgorithm rsa-sha256
UserID opendkim:opendkim
Socket inet:8891@127.0.0.1
Selector mail
Connect the milter to Postfix:
sudo nano /etc/default/opendkim
(Text to be placed in the text file: ) SOCKET="inet:8891@localhost"
Configure postfix to use this milter:
sudo nano /etc/postfix/main.cf
(Text to be placed AT THE END in the text file: ) milter_protocol = 2 milter_default_action = accept smtpd_milters = inet:127.0.0.1:8891 non_smtpd_milters = inet:127.0.0.1:8891
Create a directory structure that will hold the trusted hosts, key tables, signing tables and crypto keys:
sudo mkdir -pv /etc/opendkim/keys/DOMAIN.TLD
Specify trusted hosts:
sudo nano /etc/opendkim/TrustedHosts
(Text to be placed in the text file: ) 127.0.0.1 localhost 192.168.0.1/24 *.DOMAIN.TLD
Create a key table:
sudo nano /etc/opendkim/KeyTable
(Text to be placed in the text file: Be very careful, it needs to be on a SINGLE LINE for each domain ) mail._domainkey.DOMAIN.TLD DOMAIN.TLD:mail:/etc/opendkim/keys/DOMAIN.TLD/mail.private
Create a signing table:
sudo nano /etc/opendkim/SigningTable
(Text to be placed in the text file: ) *@DOMAIN.TLD mail._domainkey.DOMAIN.TLD
Now we generate the keys ! smile
sudo cd /etc/opendkim/keys/DOMAIN.TLD sudo opendkim-genkey -s mail -d DOMAIN.TLD
Output the DKIM DNS line to the terminal. Then, we install it on our DNS server. My ZONE file looks like this. (Be very careful with the formatting, the "p=...." needs to be in a single line.
cat mail.txt
mail._domainkey IN TXT "v=DKIM1; k=rsa; p=AAAKKUHGCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPFrBM54eXlZPXLJ7EFphiA8qGAcgu4lWuzhzxDDcIHcnA/fdklG2gol1B4r27p87rExxz9hZehJclaiqlaD8otWt8r/UdrAUYNLKNBFGHJ875467jstoAQAB" ; ----- DKIM key mail for DOMAIN.TLD
And we don't forget to put the right rights otherwise opendkim will get grumpy...
chown -Rv opendkim:opendkim /etc/opendkim*
And finally, we restart everything :
sudo service opendkim restart
sudo service postfix restart
To test if it is all working well (don't forget that the DNS propagation can take a bit of take....) you can simply send an email to check-auth@verifier.port25.com and a reply will be received. If everything works correctly you should see DKIM check: pass under Summary of Results.