Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a postfix/dkimproxy setup that doesn't work the way I like.

I have with SPF allowing mail only from (rDNS mapped correctly) which is also aliased by

Currently, web applications running on the server use Postfix's builtin sendmail command when sending outbound emails. These emails come from and they are properly DKIM-signed. That is correct!

When a user with (me!!) sends mail from Outlook it connects to and authenticates after STARTTLS command. Unfortunately, emails are not DKIM signed. Logs show that the email is automatically relayed and doesn't go through dkimproxy. dkimproxy is configured as follows

# specify what address/port DKIMproxy should listen on

# specify what address/port DKIMproxy forwards mail to

# specify what domains DKIMproxy can sign for (comma-separated, no spaces)

# specify what signatures to add
signature dkim(c=simple)
signature domainkeys(c=nofws)

# specify location of the private key
keyfile   /etc/ssl/private/dkim_server/dkim_server.key

# specify the selector (i.e. the name of the key record put in DNS)
selector  server

DNS TXT records are already set.

Postfix is configured with a large file that I won't paste in its entirety. The relevant lines are

# modify the default submission service to specify a content filter
# and restrict it to local clients and SASL authenticated clients only
submission  inet  n     -       n       -       -       smtpd
    -o smtpd_etrn_restrictions=reject
    -o smtpd_sasl_auth_enable=yes
    -o content_filter=dksign:[]:10027
    -o receive_override_options=no_address_mappings
    -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject

# specify the location of the DomainKeys signing filter
dksign    unix  -       -       n       -       10      smtp
    -o smtp_send_xforward_command=yes
    -o smtp_discard_ehlo_keywords=8bitmime,starttls

# service for accepting messages FROM the DomainKeys signing filter
# inet  n  -      n       -       10      smtpd
    -o content_filter=
    -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
    -o smtpd_helo_restrictions=
    -o smtpd_client_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=permit_mynetworks,reject
    -o mynetworks=
    -o smtpd_authorized_xforward_hosts=

The question is

Why doesn't mail coming from the external get processed by dkimproxy?

share|improve this question
That configuration looks correct. Are you sure that Outlook is connecting on port 587 to send mail (instead of 25)? – mgorven May 18 '12 at 18:50
Outlook is connecting to 25. That is default value. What's wrong with 25? – usr-local-ΕΨΗΕΛΩΝ May 18 '12 at 20:40
Switching to 587 did work! But question above is still active because I would like to understand. If you could answer the question I'll upvote and accept – usr-local-ΕΨΗΕΛΩΝ May 18 '12 at 20:52
up vote 2 down vote accepted

You need to make sure that Outlook is connecting to the submission port (port 587), instead of port 25. This is because the Postfix configuration works by signing mail received on port 587 (i.e. from your clients sending outgoing mail), but not mail received on port 25 (because this is mail being delivered to your server by other MTAs). This is implemented by the content_filter line in, which you'll note is present in the submission inet definition, but not the smtp inet definition.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.