10

How do I use OpenDKIM with multiple domain names on a single server?

I own 3 domain names, and I have a single server that's running postfix for sending email. How do I use OpenDKIM?

Can I use the same keyfile for all 3 domain names? Do I have to create a TXT record for each domain name?

Improve this question
1
  • Haven't used OpenDKIM (but have used dkim-milter) - I find DKIMProxy to be easier to setup than a milter. In general, you do need a TXT record for every domain that you wish a recipient to verify and you can use the same keyfile for all (although it is preferable for each domain to have its own keyfile). The configuration of OpenDKIM can be found on its site.
    – cyberx86
    Aug 2, 2011 at 4:26

2 Answers 2

Reset to default
10

You'll need to set up a KeyTable with a separate line for each selector/domain/keyfile. It would look like this:

default._domainkey.example1.com example1.com:default:/etc/mail/dkim/keys/example1.com/default
default._domainkey.example2.com example2.com:default:/etc/mail/dkim/keys/example2.com/default
default._domainkey.example3.com example3.com:default:/etc/mail/dkim/keys/example3.com/default

then a SigningTable to determine who can sign on each domain:

*@example1.com default._domainkey.example1.com
*@example2.com default._domainkey.example2.com
*@example3.com default._domainkey.example3.com

Here's an easy How-To for setting it up:

http://stevejenkins.com/blog/2010/09/how-to-get-dkim-domainkeys-identified-mail-working-on-centos-5-5-and-postfix-using-opendkim/

Improve this answer
3
  • 1
    Thanks SteveJ! Is it allowed to use the same default.private key for all 3 domains? Or does that invalidate or confuse the authentication process?
    – Nic Cottrell
    Mar 30, 2012 at 9:36
  • 2
    If you are using subdomains of the same domain, you can just specify Subdomains yes in /etc/opendkim.conf
    – David Xia
    Mar 6, 2013 at 22:59
  • 1
    As of January 2022, the linked How-To isn't reachable. Here's a link to a snapshot of the page: web.archive.org/web/20210123113508/https://www.stevejenkins.com/…
    – Pistos
    Jan 20, 2022 at 0:43
1

The question is a bit dated, but the following configuration works for me.
The selector is usually default, but can be anything as long as you don't have multiple keys with the same selector.

SELECTOR=default
DOMAIN=domain.tld
# Add a rule for the new domain to the signing table (location of the signing table should be configured in opendkim.conf)
echo -e "*@${DOMAIN} ${SELECTOR}._domainkey.${DOMAIN}" | sudo tee -a /etc/opendkim/SigningTable
# Add the path to the key to the key table (again, defined in opendkim.conf)
echo -e "${SELECTOR}._domainkey.${DOMAIN} ${DOMAIN}:${SELECTOR}:/etc/opendkim/keys/${DOMAIN}/${SELECTOR}.private" | sudo tee -a /etc/opendkim/KeyTable
# Add the domain to the trusted hosts (I think this is not necessary if you send from localhost)
echo -e "${DOMAIN}" | sudo tee -a /etc/opendkim/TrustedHosts
# Create a directory for the domain's key
sudo mkdir -p /etc/opendkim/keys/${DOMAIN}
# Create the key
sudo opendkim-genkey -b 1024 -d ${DOMAIN} -D /etc/opendkim/keys/${DOMAIN} -s ${SELECTOR} -v
# Set the right ownership for the newly generated key
sudo chown opendkim: /etc/opendkim/keys -R
# This is the public key and must be added to your dns record
sudo cat /etc/opendkim/keys/${DOMAIN}/${SELECTOR}.txt

This was my source: https://easydmarc.com/blog/how-to-configure-dkim-opendkim-with-postfix/

Improve this answer

You must log in to answer this question.