signed-by in mail header is not added as I have installed and configured my domain

Question

I have checked in http://dkimcore.org/c/keycheck that my site has a valid TXT record for DKIM. My domain is myDomain.com and my selector is mail.

I used -t and says to servers to ignore errors and don't drop it in header. (If I'm wrong in any way please tell)

TXT record is also added and working. (The record has been for in dkimcore website).

Now when my domain send an email there is no signed-by in mail header.

The command I used to generate mail.txt is as below:

opendkim-genkey -t -s mail -d myDomain.com

opendkim.conf file has this line and dkim.key exists:

KeyFile                 /etc/mail/dkim.key

Where should I put mail.private which is generated by the command I explained above?

I removed -t in generation and now email is not sent at all. Error log says:

dkim_eom(): resource unavailable: d2i_PrivateKey_bio() failed

EDIT:

d2i_PrivateKey_bio() failed is resolved. When key is generated its permissions was as below:

4 -rw-r--r--  1 root root  312 Feb  6 12:43 dkim.key
4 -rw-r--r--  1 root root  887 Feb  6 12:43 mail.private

I've added both keys to opendkim group as its service is running by that user. It is bizarre that when you generate a key by opendkim-genkey the permissions are not handled correctly. Anyway I am on the previous error again. I receive the error:

connect to Milter service inet:localhost:8891: Connection refused

Is this a permission issue of folders like postfix and openDKIM?

When I change permission I cannot restart opendkim service and it fails, so I changed permissions to its first state. Now I receive the first error.

EDIT 2:

Postfix configuration:

# DKIM
milter_default_action = accept
milter_protocol = 2
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891

openDKIM configuration in /etc/default/opendkim:

SOCKET="inet:8891@localhost" # listen on loopback on port 8891

/etc/opendkim.conf:

Domain                  Mydomain.com
KeyFile                 /etc/mail/dkim.key
Selector                mail

This is the error I currently receive:

SSL error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag; error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error; error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag; error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error; error:04093004:rsa routines:OLD_RSA_PRIV_DECODE:RSA lib; error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag; error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error
dkim_eom(): resource unavailable: d2i_PrivateKey_bio() failed

Reverse DNS of domain says:

4 hours PTR *-*-*-*.nrp.co
Authoritative Nameservers
ns1.nrp.co
ns2.nrp.co
ns3.nrp.co

ServFail Response: ns2.nrp.co  
Authoritative Nameservers
ns1.nrp.co
ns3.nrp.co
ns2.nrp.co

Answer 1

The answer was that I used public key in KeyFile instead of PrivateKey:

KeyFile                 /etc/mail/dkim.key

Changed to:

KeyFile                 /etc/mail/dkim.private

The problem is gone but DKIM signature is not shown on google side. There is not error log in mail.err every thing seems working on this side.

I even digged TXT to see if DKIM is present:

dig mail._domainkey.myDomain.com TXT

; <<>> DiG 9.8.3-P1 <<>> mail._domainkey.myDomain.com TXT
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5849
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 6

;; QUESTION SECTION:
;mail._domainkey.myDomain.com.  IN  TXT

;; ANSWER SECTION:
mail._domainkey.myDomain.com. 28800 IN  TXT "v=DKIM1\; k=rsa\; t=y\; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHZPuhZKOmy4c9pA7jhYHOLIV4a0RNcBbX7NYJ04hVAj1Dm241YL9+cmhSeggt8OaJVuJKlmmFYUiCuj9UUAc7dgiqBsy+2Tvct+/FFrEhlL8lP9AtISCKkKmBTDBQ/2A6flSokQGr6CwGdLnjQXjp9JepxFjmu+J834RYCnIM1wIDAQAB

Answer 2

Have you set the reverse dns of you domain? And are you sending the sender header in you email? As per me these two are required.