Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got sednamil, dkim-milter both running on RHEL4.

DNS and config files look like:

TXT record: IN TXT "v=DKIM1; g=*; k=rsa; t=y; p=....snip...TRM3w7CuYnQIDAQAB"

TXT record: IN TXT "dkim=unknown"


Canonicalization simple
KeyFile /var/db/dkim/mail.key.pem
Selector mail
Socket inet:8891@localhost
SignatureAlgorithm rsa-sha256
Syslog Yes
Userid dkim
X-Header Yes
Mode sv
InternalHosts /etc/dkim-internal-hosts


Now, when I send an email as a test, I don't see anything in the headers about DKIM being authenticated, although the key does appear:

X-DKIM: Sendmail DKIM Filter v2.8.3 o7FLH1Wa032083
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;; s=mail;

If I type in:

# host -t txt

I get:

Host not found: 3(NXDOMAIN)

What could I be missing?

share|improve this question
typing in: dkim-testkey -d -k /var/db/dkim/mail.key.pem -s mail gives me: dkim-testkey: res_query(): `' Unknown host – NinjaCat Aug 15 '10 at 23:54
up vote 2 down vote accepted

It looks like your DNS is setup incorrectly. You need to put in your public key that you generated when initially setting up DKIM. A sample DKIM record is as follows:

$ dig +short TXT
"v=DKIM1\;" "g=*\;" "k=rsa\;" "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrZ6zwKHLkoNpHNyPGwGd8wZoNZOk5buOf8wJwfkSZsNllZs4jTNFQLy" "6v4Ok9qd46NdeRZWnTAY+lmAAV1nfH6ulBjiRHsdymijqKy/VMZ9Njjdy/+FPnJSm3+tG9Id7zgLxacA1Yis/18V3TCfvJrHAR/a77Dxd65c96UvqP3QIDAQAB"

Everything after the p= is the public key. Just paste it all on one line. The value that comes before the _domainkey is called your selector. In the twitter example above, their selector is dkim. From your /etc/dkim.conf file, it looks like your selector is called simply mail. So your DNS record should be: IN TXT "v=DKIM1; k=rsa; t=s; p=<yourpublickey>"

Once that's setup and after the record has propagated, you should get the full record when you run the following:

$ dig +short TXT

Hope this helps.

share|improve this answer
interesting... you are using t=s, rather than t=y and you don't have a g=*. I'll update my DNS now and see what happens. – NinjaCat Aug 16 '10 at 0:15
t=y means testing mode. You can use t=y for now while you get everything working, then switch it to t=s when everything is in place. g=* is assumed by default. – vmfarms Aug 16 '10 at 0:27
Weird thing is that the dig command still returns nothing... – NinjaCat Aug 16 '10 at 7:02
dig (without +sort) returns: ; IN TXT. Note that there is nothing returned after the "TXT". – NinjaCat Aug 16 '10 at 7:36
do the semicolons need to be escaped as it is in the twitter example? – NinjaCat Aug 16 '10 at 8:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.