Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've set up dkim-filter on my mail server. I've set up postfix to use dkim-filter as the milter; However, I'm getting the following in my logs:

Jul  7 13:00:29 magni postfix/smtpd[6742]: connect from[]
Jul  7 13:00:29 magni postfix/smtpd[6742]: D0F802BC74:[]
Jul  7 13:00:29 magni postfix/cleanup[6756]: D0F802BC74: message-id=<>
Jul  7 13:00:34 magni dkim-filter[7039]: D0F802BC74: key retrieval failed

Why am I getting that, and how can I stop it from happening?

share|improve this question
up vote 0 down vote accepted

Since this is an inbound connection it means you have misconfigured your dkim filter it is trying to sign instead of verify the message and cannot obtain the keys.

share|improve this answer

In my experience this also happens if a mail is sent DKIM-signed, but the DNS isn't available or doesn't report the appropriate DKIM key. In order to fix this issue, I added to the bottom of /etc/dkim-filter.conf the line:

On-DNSError accept


service dkim-filter restart

Environment: Debian Squeeze, postfix, dovecot

share|improve this answer

The dkim-filter project has been abandoned for over 2 years now. Please use the updated and current opendkim package to provide this functionality. The same author who wrote dkim-filter forked it and it became the opendkim project, except now it has 2 years of bugfixes and enhancements. One of those enhancements was the ar library (asynchronous resolver, i.e. dns lookups), where multiple of these weird types of "unable to retrieve record" errors have been fixed.

Chances are that your distribution has current opendkim packages available. There is also a very good howto for Opendkim & Postfix integration.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.