Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to weigh up whether DKIM signing should be done by the application sending mail (for instance, the mailing list software you're using) or at the mail transfer agent (sendmail, postfix etc).

Do you know any good arguments either way?

As far as I can see, doing it at the MTA, such as with dkim-milter, is a lot easier to set up.

However, if anyone gets access to the server, even just a normal unprivileged account such as a web hosting client's login, they'd be able to send email using sendmail and get the full blessing of my DKIM signature.

What do you think is the best solution for my situation? I'm using a Debian server with apache, postfix, php&mysql, etc.

share|improve this question
    
'if anyone gets access to the server' - it's a server, you should have secured it. And if your server get's hacked, having a DKIM signature is probably the least of your worries. –  Chris S May 4 '10 at 3:28

3 Answers 3

up vote 1 down vote accepted

I run ours at the MTA level on our Windows SMTP server with this product.

This was much easier for us to setup as well.

My attitude is is to protect the SMTP server with other protection measures (firewall, network segmentation, acl's, etc). If someone does get to that server then the least of my concerns is if SPAM is being sent out -- my server has already been owned by someone else :)

share|improve this answer
    
Thanks for your answer. A would-be phisher wouldn't necessarily need to fully own your server at root level to send out mail in your name - it would be enough just for one of your users/clients to have poor password hygiene allowing someone into their limited user account. However I see your point that it's still my problem if that happens. Just not sure how to mitigate it. –  thomasrutter May 6 '10 at 2:35

I believe the MTA is the appropriate and sensible place and a whole lot easier to implement and maintain. Why would you want the headaches of trying to do this on every client, even if that client is capable of it?

share|improve this answer
3  
+1, Not to mention you'd have to distribute the private key to every client. Not a good idea from a security prospective. –  Chris S May 4 '10 at 3:27
    
@Chris S, each application/client could use a different key. DKIM allows for different keys per hostname and even within one hostname. I would have thought that from a security perspective, each client having their own key would be much better than to sign all clients' mail with the one private key. Not saying leaving it to the clients is better, just should be better from a security perspective, and of course security is usually at odds with convenience. –  thomasrutter May 6 '10 at 2:39
    
@Thomasrutter: I believe in general, the more you can remove the security mechanism from the client and place it on a limited-access server, the safer the situation. Using a different key for each mail server makes perfect sense for the reasons you cited. If you're going to be configuring it on every client machine, versus one or two mail servers, the administrative overhead would be noticeable at the least. –  Chris S May 6 '10 at 12:46
    
Granted that DKIM could be done at the client, IF the client happens to be one that supports it, but who amongst us wants the work of having to implement and maintain that beast? Certainly not me. –  John Gardeniers May 6 '10 at 21:19

The DKIM signatures usually contain headers only the MTA would know about: eg; Message-ID and Received.

share|improve this answer
    
Message-ID is often generated by the MUA. –  grawity Jun 3 '10 at 11:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.