Comments on Set Up Postfix DKIM With dkim-milter

Everybody probably already knows this, but the options are missing on the RPM line above in the "installation" section. It should be (at least for my CentOS 5.2 installation):

rpm -Uvh http://www.c-corp.net/linux/centos/5/general/RPMS/i386/dkim-milter-2.2.1-1.i386.rpm --nodeps

 instead of:

rpm http://www.c-corp.net/linux/centos/5/general/RPMS/i386/dkim-milter-2.2.1-1.i386.rpm --nodeps

- Paul Rupp, Acorp Computers [Brookings, South Dakota]

Hi all,

I already followed the guidelines, everything seemed fine. However, when I sent an email to a yahoo email address, we could not pass the domain authorization check and find the signature as well.

In addition, we also found that there was no any domain signature header to be appended in an email when we sent it to yahoo.

Do any linux expert know the reason? this problem really annoys us and we are very frustrated now. Please help !!!

I have set it up too and everything seems to work fine until I send a mail to yahoo and get no verification.

I proceed to check the headers and I see the following lines.

I believe there are some tags missing.

 There are no errors posted in my /etc/postfix/maillog

 X-DKIM: Sendmail DKIM Filter v2.2.1 <server hostname> 36C1921CA17
Message-ID: <[email protected]>

 What do I need to check for the full dkim tags to be appended to the messages?

Yahoo still uses domainkeys not DKIM

Hi topdog, what are you basing that theory on? I do DKIM checks all the time on yahoo. An to be honest, yahoo is one of the few that leads on the DKIM front.

 Tell us more please.

Yes thats what you do for multiple domains, they need to use the same key though.

I've made some minor changes to your init script to work with multiple domains:

39a40
> PORTS=()
69a71
>   PORTS[${NUM}]="$LPORT"
97,98c99,100
<               if [[ ! -z $(echo $PORT |grep "local") && $RETVAL -eq 0  ]]; then
<                         TPORT=$(echo $PORT | sed -e "s/local://")
---
>               if [[ ! -z $(echo ${PORTS[$i]} |grep "local") && $RETVAL -eq 0  ]]; then
>                         TPORT=$(echo ${PORTS[$i]} | sed -e "s/local://")

Hi Andras

I tried to setup this. But it seems that doesn´t work. What must I write in my /etc/sysconfig/dkim-milter to use it with multiple domains

SIGNING_DOMAIN="domain1.com, domain2.com "

Like this?

This howto is dated, if you want flexibility with multiple domains just grab my newer rpm's at http://www.topdog-software.com/oss/dkim-milter/

Thanks for this. It's a good intro to getting DKIM up and running but it lacks some functionality, particularly multiple domains / keys (keylist). For production use you'd be better of building from source (you'll need dev packages for sendmail and openssl) or just grab the Fedora 10 dkim-milter rpm and hack that its worth the effort.

post you message headers lets see may be they have changed, as far as i know google was leading with DKIM adoption.

Hi everyone,

I recently went through the updated tutorial (http://www.topdog.za.net/postfix_dkim_milter) and had some issues getting my dkim to work. My outbound mail would contain the signature, but when I ran the email tests they would fail. I found out that I had not formatted my txt dns entry correctly (I use network solutions and had to enter it in 2 parts using their ADNS manager).

Per some of the dkim documentation (http://www.dkim.org/specs/rfc4871-dkimbase.html#def-tag-list), if you have s=selector.pem and d=something.tld tags in your signature (which after following the tutorial, I did have), the proper dns name for the txt record should be selector.pem._domainkey.something.tld

For example:

s=selector.pem

d=somerandomdomain.net

the txt dns record should be addressible like this:

selector.pem._domainkey.somerandomdomain.net

Note: If you use network  solutions for your dns, pay attention to the notices about what constitutes an acceptable txt entry. It should be listed on the page where you enter your txts.

I've created an updated howto for DKIM on CentOS here here.

FYI - the dkim-milter package has been abandoned for years and has been replaced by OpenDKIM (which was forked from dkim-milter in 2009). OpenDKIM is in the Fedora 14+ repos and EPEL for RHEL/CentOS users. Just do "yum install opendkim"

More info on OpenDKIM at http://opendkim.org/