Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Ive been struggling the last couple of hours with setting up DKIM on my Postfix/CentOS 5.3 server.

It finally sends and signs the emails, but apparently Google still does not like it. The errors I'm getting are:

dkim=neutral (bad version)

from googles "show original" interface.

This is what my DKIM-signature header look like:

v=1; a=rsa-sha1; c=simple/simple;; s=default; t=1267326852; bh=0wHpkjkf7ZEiP2VZXAse+46PC1c=; h=Date:From:Message-Id:To:Subject; b=IFBaqfXmFjEojWXI/WQk4OzqglNjBWYk3jlFC8sHLLRAcADj6ScX3bzd+No7zos6i KppG9ifwYmvrudgEF+n1VviBnel7vcVT6dg5cxOTu7y31kUApR59dRU5nPR/to0E9l dXMaBoYPG8edyiM+soXo7rYNtlzk+0wd5glgFP1I=

Very appreciative of any suggestions as to how I can solve this problem!

Btw, here is exactly how I installed dkim-milter in CentOS 5.3 for postfix, if anyone is interested (based on this guide):

mkdir dkim-milter
cd dkim-milter

Newest version:

rpm -Uvh dkim-milter-2.8.3-1.x86_64.rpm
/usr/bin/dkim-genkey -r -d

add contents of default.txt to DNS as TXT
_ssp._domainkey TXT dkim=unknown
_adsp._domainkey TXT dkim=unknown
default._domainkey TXT v=DKIM1; g=*; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GWETBNiQKBgQC5KT1eN2lqCRQGDX+20I4liM2mktrtjWkV6mW9WX7q46cZAYgNrus53vgfl2z1Y/95mBv6Bx9WOS56OAVBQw62+ksXPT5cRUAUN9GkENPdOoPdpvrU1KdAMW5c3zmGOvEOa4jAlB4/wYTV5RkLq/1XLxXfTKNy58v+CKETLQS/eQIDAQAB

mv default.private default
mkdir /etc/mail/dkim/keys/
mv default /etc/mail/dkim/keys/
chmod 600 /etc/mail/dkim/keys/
chown dkim-milt.dkim-milt /etc/mail/dkim/keys/

vim /etc/dkim-filter.conf
ADSPDiscard             yes
ADSPNoSuchDomain        yes
AllowSHA1Only           no
AlwaysAddARHeader       no
AutoRestart             yes
AutoRestartRate         10/1h
BaseDirectory           /var/run/dkim-milter
Canonicalization        simple/simple
Domain         #add all your domains here and seperate them with comma
ExternalIgnoreList      /etc/mail/dkim/trusted-hosts
InternalHosts           /etc/mail/dkim/trusted-hosts
KeyList                 /etc/mail/dkim/keylist
LocalADSP               /etc/mail/dkim/local-adsp-rules
Mode                    sv
MTA                     MSA
On-Default              reject
On-BadSignature         reject
On-DNSError             tempfail
On-InternalError        accept
On-NoSignature          accept
On-Security             discard
PidFile                 /var/run/dkim-milter/
QueryCache              yes
RemoveOldSignatures     yes
Selector                default
SignatureAlgorithm      rsa-sha1
Socket                  inet:20209@localhost
Syslog                  yes
SyslogSuccess           yes
TemporaryDirectory      /var/tmp
UMask                   022
UserID                  dkim-milt:dkim-milt
X-Header                yes

vim /etc/mail/dkim/keylist

vim /etc/postfix/
======S====== Add:
smtpd_milters = inet:localhost:20209
non_smtpd_milters = inet:localhost:20209
milter_protocol = 2
milter_default_action = accept

vim /etc/mail/dkim/trusted-hosts


/sbin/chkconfig dkim-milter on
/etc/init.d/dkim-milter start
/etc/init.d/postfix restart
share|improve this question
up vote 1 down vote accepted

Solution: Turns out I missed that my DNS host automatically makes all entries into lower case (for reasons unknown to anyone but themselves). This means the "v=DKIM1" turned into "v=dkim1" which is an invalid version. It also means it turned by base64 hash into all lower case, thus breaking it.

Now getting in contact with my host to make them change their system. Hope this helps someone!

share|improve this answer
Let me guess.. GoDaddy? :D – Ruslan Abuzant Oct 30 '12 at 21:50

This problem is at least not related to your penguin box, leave it alone.

Start with where you manage DNS entries and:

  • Make sure you REMOVE all previous DKIM entries, even if they "look" the same..
  • Save Your Zone, make sure entries deleted.
  • Add your (proper/new/old/verified) DKIM signature line again ..
  • Double check the t=y part in there..
  • Save Zone File
  • Check CapitAliZatioN of the DKIM line..and again please!

Good luck

share|improve this answer

dkim=neutral (bad version) header.iI have same problem, an answer here . You need to add DKIM_CANON

share|improve this answer
Welcome to Server Fault. Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – Michael Hampton Sep 1 '13 at 16:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.