Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have DKIM configured in Exim for outgoing mail, as per the documentation. Exim signs all outgoing mail. But some of those outgoing messages are forwards, thanks to a user's .forward file. This is a problem for me, because some of those forwards are spam (my exim configuration does not do any verification) and I don't want to take responsibility for them. But I can't figure out how to configure Exim not to sign these messages.

My configuration is basically the Debian Squeeze default, with a few DKIM_* macros set. I can post more details, but I think seeing any example of conditional DKIM signing would set me right.

share|improve this question

2 Answers 2

Bit of a necropost, but I simply use a line:

dkim_private_key = ${if or {{!def:sender_host_address}{def:authenticated_id}}{DKIM_PRIVATE_KEY}{}}

(where DKIM_PRIVATE_KEY is a macro giving the path to my dkim private key).

Then if this is a 'locally-originated' message (so $sender_host_address is undefined) or the email comes from an authenticated user, dkim_private_key will be set, and the message will be signed.

Else (which should just mean we're forwarding a message, assuming we're not a relay), dkim_private_key will be the empty string which (from the specs) means the message won't be signed.

share|improve this answer

I have a similar setup (though I do spam/virus scan my forwarded email, which I strongly advise you SHOULD do too). I have a router that detects forwarded email, and a router that detects smtp auth, and a router that detects when it's coming from the webmail system. In your case, you can use the presence of a ~/.forward file to help make a decision that it is a forwarder instead of a local delivery. Each router sets a specific transport that is designed for each case. The transports are where the signing is either done or not done. As you can see by my transport config below, I DKIM sign webmail and smtp auth, but not forwarders:

remote_smtp_authenticated:
  debug_print = "Transport: remote_smtp_authenticated for $local_part@$domain"
  driver = smtp
  max_rcpt = 10
  hosts_max_try = 2
.include_if_exists /etc/exim/dkim_transports.conf

remote_smtp_webmail:
  debug_print = "Transport: remote_smtp_webmail for $local_part@$domain"
  driver = smtp
  max_rcpt = 10
  hosts_max_try = 2
.include_if_exists /etc/exim/dkim_transports.conf

remote_smtp_forwarder:
  debug_print = "Transport: remote_smtp_forwarder for $local_part@$domain"
  driver = smtp
  max_rcpt = 10
  hosts_max_try = 2

The dkim_transports.conf simply sets all the dkim_* settings using a series of macros specifically designed for my site:

CentOS58[root@ivwm51 exim]# more dkim_transports.conf
.ifdef DKIM_SIGNING
  dkim_domain = DKIM_DOMAIN
  dkim_selector = DKIM_SELECTOR
  dkim_private_key = DKIM_PRIVATE_KEY
.endif

You can model yours similarly.

share|improve this answer
    
Thanks. I don't understand how the "router that detects forwarded email" works. My forwarding is done by the redirect router; but I can't specify a transport there, nor is that really the right place for it. Can you show the configuration for the router that directs to remote_smtp_forwarder? –  Andrew Oct 25 '12 at 16:45
1  
I know this one is really old, but I came across this with the same question as @Andrew in mind, so I want to post what I found out: For me it helped to use the following condition in the router: condition = ${if eq{${lc:$sender_address_domain}}{$qualify_domain}} This is only true if the mail is sent by a local user. These are the cases when I want DKIM, in all other cases, I don't want DKIM. –  fabstab Aug 12 at 22:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.