I have a postfix/dkimproxy setup that doesn't work the way I like.
I have exampledomain.org
with SPF allowing mail only from server.exampledomain.org
(rDNS mapped correctly) which is also aliased by smtp.exampledomain.org
.
Currently, web applications running on the server use Postfix's builtin sendmail
command when sending outbound emails. These emails come from [email protected]
and they are properly DKIM-signed. That is correct!
When a user with @exampledomain.org
(me!!) sends mail from Outlook it connects to smtp.exampledomain.org
and authenticates after STARTTLS
command. Unfortunately, emails are not DKIM signed. Logs show that the email is automatically relayed and doesn't go through dkimproxy
. dkimproxy is configured as follows
# specify what address/port DKIMproxy should listen on
listen 127.0.0.1:10027
# specify what address/port DKIMproxy forwards mail to
relay 127.0.0.1:10028
# specify what domains DKIMproxy can sign for (comma-separated, no spaces)
domain server.exampledomain.org,exampledomain.org
# specify what signatures to add
signature dkim(c=simple)
signature domainkeys(c=nofws)
# specify location of the private key
keyfile /etc/ssl/private/dkim_server/dkim_server.key
# specify the selector (i.e. the name of the key record put in DNS)
selector server
DNS TXT records are already set.
Postfix is configured with a large master.cf file that I won't paste in its entirety. The relevant lines are
#
# modify the default submission service to specify a content filter
# and restrict it to local clients and SASL authenticated clients only
#
submission inet n - n - - smtpd
-o smtpd_etrn_restrictions=reject
-o smtpd_sasl_auth_enable=yes
-o content_filter=dksign:[127.0.0.1]:10027
-o receive_override_options=no_address_mappings
-o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
#
# specify the location of the DomainKeys signing filter
#
dksign unix - - n - 10 smtp
-o smtp_send_xforward_command=yes
-o smtp_discard_ehlo_keywords=8bitmime,starttls
#
# service for accepting messages FROM the DomainKeys signing filter
#
127.0.0.1:10028 inet n - n - 10 smtpd
-o content_filter=
-o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
-o smtpd_helo_restrictions=
-o smtpd_client_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o mynetworks=127.0.0.0/8
-o smtpd_authorized_xforward_hosts=127.0.0.0/8
The question is
Why doesn't mail coming from the external get processed by dkimproxy?