Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've configured DKIM (milter-dkim) on my mail server. Incoming e-mail sent from my domain now containts the following header:

X-DKIM: Sendmail DKIM Filter v2.8.3 MYDOMAIN.com o7FLH1Wa032083
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=mydomain.com; s=mail;
 t=1281907022; bh=frcCV1k9oG9oKj3dpUqdJg1PxRT2RSN/XKdLCPjaYaY=;
 h=Message-ID:Date:Subject:From:To:MIME-Version:Content-Type:
  Content-Transfer-Encoding;
 b=qetPkilXBdjnuqiKIyvAwsvTvJfAnq5urdgp/i7p/uLJ8DB+svy9A8C6CPmcfELsJ
  hDid5k2AN5JD+wM2INmUIgjeAa/IwpGTbuMloj0Wioh4njqIfbATJqOhuqxTjic

1.) So I guess that confirms that I have DKIM setup correctly, right?

But when I look at a message coming in from Google, I see:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=gamma;
   ...snip...
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
   ...snip...

2.) What is the relationship of DomainKey-Signature vs DKIM-Signature?

share|improve this question
add comment

3 Answers

up vote 1 down vote accepted

DKIM is a newer version of the DomainKeys protocol. If you sign your mail via DKIM, you should not need to implement DomainKeys.

share|improve this answer
    
Ah OK... So I wonder then, why Google/Facebook, et al. do both? is it just a legacy thing? –  NinjaCat Aug 15 '10 at 22:39
3  
They are quite different and distinct. DKIM is generally considered the successor to Domain Keys but using DKIM does NOT mean you don't need Domain Keys, as the latter is still being checked by a great many systems. Far better to implement both if possible. –  John Gardeniers Aug 20 '10 at 1:19
add comment

They are two separate things. DomainKeys is older, created by Yahoo!. DKIM is DomainKeys + Identified Internet Mail (another scheme to verify emails created by Cisco).

The headers are compatible, apparently, but some newer systems don't check DKIM, so you have to generate both to make everyone happy.

share|improve this answer
add comment

To answer your first question, it means that your outgoing mail is being signed, but you must have the corresponding DNS records in order for receiving mail servers to validate it.

When it's all setup, if you check your headers for a message that's come in, your mail server should provide some indication of it's success. If you have a Google account, it will display the results under the 'Authentication-Results' header. If it's setup correctly, you should see the following:

Authentication-Results: mx.google.com; spf=pass (google.com: domain of
root@example.com designates 1.1.1.1 as permitted sender)
smtp.mail=root@example.com; dkim=pass header.i=@example.com

Remember to setup SPF records too, they are more widely checked than DKIM/DomainKeys.

Question 2, DKIM is the newer implementation. If you have the ability to use DKIM, use it over DomainKeys.

share|improve this answer
    
I have SPF working perfectly... Oh wait... I don't see the "Authentication-Results:" part in the headers at all for DKIM... –  NinjaCat Aug 15 '10 at 22:51
1  
Are you checking the headers from a Google account? "Authentication-Results" is a custom Google header. Other providers may or may not show the same headers. If you have a Google account, send a test message from your server to it, and click on the little drop down arrow beside "Reply" and go to "Show Original". You should see that header, even if you just have SPF records. –  vmfarms Aug 15 '10 at 23:00
    
Yeah, I am looking via gmail, and I don't see anything about teh authentication results. I am going to create a new question now, since we're getting off topic... b/c this is more of an issue than my original question. –  NinjaCat Aug 15 '10 at 23:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.