1

I'm trying to weigh up whether DKIM signing should be done by the application sending mail (for instance, the mailing list software you're using) or at the mail transfer agent (sendmail, postfix etc).

Do you know any good arguments either way?

As far as I can see, doing it at the MTA, such as with dkim-milter, is a lot easier to set up.

However, if anyone gets access to the server, even just a normal unprivileged account such as a web hosting client's login, they'd be able to send email using sendmail and get the full blessing of my DKIM signature.

What do you think is the best solution for my situation? I'm using a Debian server with apache, postfix, php&mysql, etc.

Improve this question
1
  • 'if anyone gets access to the server' - it's a server, you should have secured it. And if your server get's hacked, having a DKIM signature is probably the least of your worries.
    – Chris S
    May 4, 2010 at 3:28

3 Answers 3

Reset to default
1

I run ours at the MTA level on our Windows SMTP server with this product.

This was much easier for us to setup as well.

My attitude is is to protect the SMTP server with other protection measures (firewall, network segmentation, acl's, etc). If someone does get to that server then the least of my concerns is if SPAM is being sent out -- my server has already been owned by someone else :)

Improve this answer
1
  • Thanks for your answer. A would-be phisher wouldn't necessarily need to fully own your server at root level to send out mail in your name - it would be enough just for one of your users/clients to have poor password hygiene allowing someone into their limited user account. However I see your point that it's still my problem if that happens. Just not sure how to mitigate it.
    – thomasrutter
    May 6, 2010 at 2:35
2

I believe the MTA is the appropriate and sensible place and a whole lot easier to implement and maintain. Why would you want the headaches of trying to do this on every client, even if that client is capable of it?

Improve this answer
4
  • 3
    +1, Not to mention you'd have to distribute the private key to every client. Not a good idea from a security prospective.
    – Chris S
    May 4, 2010 at 3:27
  • @Chris S, each application/client could use a different key. DKIM allows for different keys per hostname and even within one hostname. I would have thought that from a security perspective, each client having their own key would be much better than to sign all clients' mail with the one private key. Not saying leaving it to the clients is better, just should be better from a security perspective, and of course security is usually at odds with convenience.
    – thomasrutter
    May 6, 2010 at 2:39
  • @Thomasrutter: I believe in general, the more you can remove the security mechanism from the client and place it on a limited-access server, the safer the situation. Using a different key for each mail server makes perfect sense for the reasons you cited. If you're going to be configuring it on every client machine, versus one or two mail servers, the administrative overhead would be noticeable at the least.
    – Chris S
    May 6, 2010 at 12:46
  • Granted that DKIM could be done at the client, IF the client happens to be one that supports it, but who amongst us wants the work of having to implement and maintain that beast? Certainly not me.
    – John Gardeniers
    May 6, 2010 at 21:19
0

The DKIM signatures usually contain headers only the MTA would know about: eg; Message-ID and Received.

Improve this answer
1
  • Message-ID is often generated by the MUA.
    – u1686_grawity
    Jun 3, 2010 at 11:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .