Set Up DKIM On Postfix With dkim-milter (CentOS 5.2)

Want to support HowtoForge? Become a subscriber!
 
Submitted by topdog (Contact Author) (Forums) on Fri, 2009-04-03 13:33. :: CentOS | Postfix

Set Up DKIM On Postfix With dkim-milter (CentOS 5.2)

Version 1.2
Author: Andrew Colin Kissa <andrew [at] topdog [dot] za [dot] net>
Last edited 01/04/2009

This howto has been superseded by http://www.topdog.za.net/postfix_dkim_milter

Introduction

DKIM is an authentication framework which stores public-keys in DNS and digitally signs emails on a domain basis. It was created as a result of merging Yahoo's domainkeys and Cisco's Identified Internet mail specification. It is defined in RFC 4871.

We will be using the milter implementation of dkim http://dkim-milter.sf.net on CentOS 5.2.

 

Installation

I provide Centos rpms for Dkim-milter at http://www.topdog-software.com/oss/ so we will install the latest version.

  • Install the rpm, ( 32bit and 64bit intel supported )

# wget http://www.topdog-software.com/oss/roundcube/andrew_topdog-software.com_key.txt
# rpm --import andrew_topdog-software.com_key.txt
# http://www.topdog-software.com/oss/dkim-milter/dkim-milter-2.8.2-0.$(uname -i).rpm

 

Generate the Keys

# sh /usr/share/doc/dkim-milter-2.8.2/dkim-genkey.sh -r -d <domain_name>

Replace <domain_name> with the domain name you will be signing the mail for. The command will create two files.

  • default.txt - contains the public key you publish via DNS
  • default.private - the private key you use for signing your email

Move the private key to the dkim-milter directory and secure it.

# mv default.private /etc/mail/dkim/default.key.pem
# chmod 600 /etc/mail/dkim/default.key.pem
# chown dkim-milt.dkim-milt /etc/mail/dkim/default.key.pem

 

DNS Setup

You need to publish your public key via DNS, client servers use this key to verify your signed email. The contents of default.txt is the line you need to add to your zone file a sample, is below

default._domainkey IN TXT "v=DKIM1; g=*; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDG81CNNVOlWwfhENOZEnJKNlikTB3Dnb5kUC8/zvht/S8SQnx+YgZ/KG7KOus0By8cIDDvwn3ElVRVQ6Jhz/HcvPU5DXCAC5owLBf/gX5tvAnjF1vSL8ZBetxquVHyJQpMFH3VW37m/mxPTGmDL+zJVW+CKpUcI8BJD03iW2l1CwIDAQAB"

; ----- DKIM default for topdog-software.com

Also add this to your zone file.

_ssp._domainkey IN TXT "t=y; dkim=unknown"

 

Configuration

  • Create the file /etc/sysconfig/dkim-milter with the contents below overwriting the existing sample file that was installed by the rpm, Make sure you set the SIGNING_DOMAIN variable to the domain or domains you will be signing mail for.
USER="dkim-milt"
PORT="inet:20209@localhost"
SIGNING_DOMAIN="<domain_name>"

SELECTOR_NAME="default"
KEYFILE="/etc/mail/dkim/default.key.pem"
SIGNER=yes
VERIFIER=yes
CANON=simple
SIGALG=rsa-sha1
REJECTION="bad=r,dns=t,int=t,no=a"
EXTRA_ARGS="-h -l -D"

 

Configure Postfix

You need to add the following options to the postfix main.cf file to enable it to use the milter.

smtpd_milters = inet:localhost:20209
non_smtpd_milters = inet:localhost:20209

Append the dkim-milter options to the existing milters if you have other milters already configured.

Start dkim-milter and restart postfix

# service dkim-milter start
# service postfix restart

 

Testing

Send an email to sa-test@sendmail.net or autorespond+dkim@dk.elandsys.com, you will receive a response stating if your setup is working correctly. If you have a Gmail account you can send an email to that account and look at the message details similar to the picture below, you should see signed-by "your domain" if your setup was done correctly.

Click to enlarge

 

Previous versions

 

Updates

Updated rpms are always provided at http://www.topdog-software.com/oss/dkim-milter/


Please do not use the comment function to ask for help! If you need help, please use our forum.
Comments will be published after administrator approval.
Submitted by Wosley (not registered) on Thu, 2010-02-18 14:20.

Hello to all,

First, big thanks for the tutorial.

I`ve fallow all steps but in the end i`ve got stuck with this:

Feb 18 15:07:56 **** postfix/cleanup[21151]: warning: cannot receive milters via service cleanup socket socket
Feb 18 15:07:56 **** postfix/smtpd[21143]: warning: premature end-of-input on public/cleanup socket while reading input attribute name
Feb 18 15:07:56 **** postfix/smtpd[21143]: warning: cannot send milters to service public/cleanup socket
Feb 18 15:07:56 **** postfix/smtpd[21143]: BA976B1D3D0: client=unknown[192.168.1.103], sasl_method=LOGIN, sasl_username=johndoe
Feb 18 15:07:56 **** postfix/master[21136]: warning: process /usr/libexec/postfix/cleanup pid 21151 killed by signal 11
Feb 18 15:07:56 **** postfix/master[21136]: warning: /usr/libexec/postfix/cleanup: bad command startup -- throttling
 

 If other ppl get the same errors maybe some clarification will be welcome on this tutorial.

Best regards,

Submitted by Marvin Yoingco (not registered) on Wed, 2010-06-09 23:53.

I resolved this issue by disabling SELinux. Here's the link on how to do this. http://www.electrictoolbox.com/switch-off-selinux-centos-5/

 It seems that SELinux is blocking the access to the said interface:port.

 

Submitted by peter (not registered) on Mon, 2009-07-06 03:47.

Hi, I'm on centOS 5.3.  First of all my request is to also be clear how to specify the DNS for thos of us who don't host our own DNS (I have mine with name.com) - because when we input our txt fields there is no place to put "ssp" or "default" I think.  

 I've followed the instructions to the end, but unfortunately when I do 'service dkim-milter start' I get

 Starting DKIM milter (dkim-filter #0): dkim-filter: smfi_opensocket() failed                                                          [FAILED]

 Do I also need to open up another port manually?

 Thanks for your help!

Submitted by Aguilar (not registered) on Sat, 2009-06-06 20:23.
Thank you very much for this tutorial, i followed this instructions and worked perfectly, i need this to participate of Yahoo Complaint Feedback
Submitted by Zak Kinion (not registered) on Sat, 2009-05-09 01:58.

Lets say if my server is an A entry and MX entry,  mailcenter.pokermac.com.ar   and is on a seperate server than pokermac.com.ar,  do I need to setup the dkim key as a subdomain, since invites@mailcenter.pokermac.com.ar is where the mail is actually sent from?

 

 Like

_ssp._domainkey.yourdomain.com TXT t=y; o=-
default._domainkey.yourdomain.com TXT v=DKIM1; g=*; k=rsa; .....

 Is there like _ssp._domainkey.mailcenter.pokermac.com.ar    or should I use:

 _ssp._domainkey.pokermac.com.ar  ????

 

 

Submitted by Pamie (not registered) on Sun, 2009-05-03 15:43.

Can you elaborate the entire steps , 

I have minutely followed the above instructions but still it wont work.

Thank you.

Submitted by orefalo (not registered) on Mon, 2009-05-04 14:48.
It does work, but you have to be careful about the certificate names, check the scripts and you will soon figure it out