exim dkimproxy configuration - explanation?

Question

I'm trying to setup DKIM on exim in a cPanel VPS.

I'm going with the DKIM Proxy option since cPanel is seriously dragging its feet with the it's-definitely-coming 11.32 release.

These guides here, here, and here has some reasonable steps to get that going. This is a clean guide too.

They don't detail some aspects much, in particular what the exim conf changes do.

Question 1.

With these steps:

At the beginning of the routers section in exim.conf:

dkimproxy:
driver = manualroute
condition = "${if eq {$interface_port}{10025} {0}{1}}"
transport = dkimproxy_smtp
route_list = "* localhost byname"
self = send

transports section in exim.conf (does not matter where):

dkimproxy_smtp:
driver = smtp
port = 10027
allow_localhost

What does this do?

Does it create an path were mail is routed out of exim onto dkimproxy, then back into exim for proper delivery?

From my testing, it appears that the mail is properly signed with DKIM when I send through the server's stand smtp port (465 via ssl)

Question 2.

In exim configuration, this step is requested:

Exim should speak TLS only on port 25, otherwise, it won't be able to communicate with DKIMproxy:
tls_advertise_hosts = 0.0.0.0.25

Why?

Question 3

Independently of the installation, there's a lot of recommendations for using DKIM Proxy with cPanel/Exim. How reliable is DKIM Proxy? Are there any security concerns with installing it on a server?

Thanks

Answer 1

Question 1:

The config you posted does the following:

1. It checks to see if a mail is being delivered by a connection initiated to port 10025.
2. If this is the case, it routes the mail to the smtp transport dkimproxy_smtp, along with a routelist that specifies that all domains (wildcard *) need to be sent to localhost.
3. The dkimproxy_smtp transport then makes an smtp connection to localhost (as specified in the routelist) on port 10027.

This is all it does. You've not mentioned what default port you're running exim or your dkim proxy on, but at a guess, you're expecting all mail delivered to exim for dkim signing to arrive at exim on port 10025, which then knows to process and redirect to the proxy which is listening on port 10027.

Question 2:

The tls_advertise_hosts parameter dictates where Exim should advertise to clients that it supports TLS. The SMTP protocol allows mailservers to advertise STARTTLS in their capabilities, and this directive lets Exim advertise this to everyone, no-one, or a subset of networks or incoming ports. Your specific example will advertise STARTTLS to any client connecting on port 25, the default SMTP port. This will allow clients to encrypt the connection to Exim.

For this to work, you need to have generated the correct TLS certificates and keys and specified them to Exim using tls_certificate and tls_privatekey. If you want to require that certain hosts must use TLS, you can use tls_hosts for this.

Question 3:

I've never used it. I've always used the latest Exim release and the baked-in DKIM capabilities without a problem. Can't comment. Sorry :(