Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a postfix/amavis relay server, with the domain name It will be a relay for dozens of VPS's, which will have domains like

So i have actually two questions. Is it possible to use dkim to sign the mails originating from the VPS's over the postfix relay on the relay server? Or have the mails to be signed on the VPS's where they are actually from?

Would an amavis configuration like this be ok?

# DKIM key
dkim_key('', 'dkim',       '/var/dkim/DKIMkey.pem');

# Cover subdomains in @dkim_signature_options_bysender_maps= ():
@dkim_signature_options_bysender_maps = ( {

# Cover subdomains
''                => { d => '' },

Or have I misunderstood the whole concept? Do I even need to sign subdomains if they are going over an relay server, or is it enough to just sign the relay server domain?

share|improve this question

I have resolved this question with OpenDKIM by using SigningTable, KeyTable and TrustedHost parameters.

  • /etc/opendkim/KeyTable – a list of keys available for signing
  • /etc/opendkim/SigningTable - a list of domains and accounts allowed to sign
  • /etc/opendkim/TrustedHosts – a list of servers to trust when signing or verifying

The guide I used can be found on this blog

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.