Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Setting up DKIM on my Postfix/CentOS 5.6 server.

It sends and signs the emails, but Google still showing it neutral. The errors I'm getting are:

dkim=neutral (bad format)

from googles "show original" interface.

This is what my DKIM-signature header look like:

DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;;; t=1342436478; bh=KpPvOZhGUmgR1WIhVC9UH5OXzTnwtnGMf7tEwI0nNfw=; h=To:Subject:Message-Id:Date:From; b=lWWQQZjSEWwSjanB0btmP0Xg0izkyqDwKsxzlUqsL/tA9JAQau6dNCYdJx7OWuNiv M3vXqrBe3uzFnvGIrQ2xbZy9DMMPmjiqUKn+KKsvmr873eYq5iG9bw6b53SkSJ6uV5 et0iLL6i3XNt/VDBQKuY1ILs+qRI60Eek/nGaXos=

please suggest me how can i solve this problem.?

share|improve this question
up vote 2 down vote accepted

I came across your question as I was setting up DKIM in our own environment. Now that I have it working (in my test environment), I wanted to respond to your question.

There are two packages (that I know of) that can be used for implementing DKIM, both of which are, as of this writing, available in the EPEL (yum) package repositories:

  1. dkim-milter
  2. OpenDKIM

I first started with dkim-milter, simply because I didn't know any better and that was the first thing I tried. After talking with some folks in the #Postfix IRC channel on Freenode, I was pointed to OpenDKIM.

dkim-milter is still available, but it hasn't been updated since 2011, and apparently is no longer maintained. OpenDKIM is a fork of dkim-milter, and from what I can tell, is the better approach.

Moral of story: I recommend OpenDKIM.

Now, you didn't tell us what you were using to sign your messages. If you still need help, then respond (or edit your question) and tell us if you're using OpenDKIM or dkim-milter (or something else).

Now that this is out of the way, using OpenDKIM, there's a command you can run, opendkim-testkey which allows you to test the key and see if its valid or not, even before you even send test messages.

I was having the exact same issue that you were, although I was able to get my key to validate with opendkim-testkey. Turns out that my issue was because I had set the "Selector" identifier in /etc/opendkim.conf to "mail01.private" when in fact my selector was simply named "mail01." The key file was named "mail01.private" but the filter itself was just "mail01" - once I made that change, the message headers in Google showed that DKIM passed.

Hope this helps!

share|improve this answer
Thanks for your kind reply i am also using opendkim for signing my mails and it's working fine. – user128296 Nov 2 '12 at 8:37

The 'bad format' message might also appear while the new DNS entries are still migrating: the signature is found in the header, but no matching DNS can be found.

share|improve this answer

It seems that Gmail doesn't like DNS TXT records for DKIM which don't include a granularity setting, ie. g=*.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.