Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have DKIM configured in Exim for outgoing mail, as per the documentation. Exim signs all outgoing mail. But some of those outgoing messages are forwards, thanks to a user's .forward file. This is a problem for me, because some of those forwards are spam (my exim configuration does not do any verification) and I don't want to take responsibility for them. But I can't figure out how to configure Exim not to sign these messages.

My configuration is basically the Debian Squeeze default, with a few DKIM_* macros set. I can post more details, but I think seeing any example of conditional DKIM signing would set me right.

share|improve this question

Bit of a necropost, but I simply use a line:

dkim_private_key = ${if or {{!def:sender_host_address}{def:authenticated_id}}{DKIM_PRIVATE_KEY}{}}

(where DKIM_PRIVATE_KEY is a macro giving the path to my dkim private key).

Then if this is a 'locally-originated' message (so $sender_host_address is undefined) or the email comes from an authenticated user, dkim_private_key will be set, and the message will be signed.

Else (which should just mean we're forwarding a message, assuming we're not a relay), dkim_private_key will be the empty string which (from the specs) means the message won't be signed.

share|improve this answer

I have a similar setup (though I do spam/virus scan my forwarded email, which I strongly advise you SHOULD do too). I have a router that detects forwarded email, and a router that detects smtp auth, and a router that detects when it's coming from the webmail system. In your case, you can use the presence of a ~/.forward file to help make a decision that it is a forwarder instead of a local delivery. Each router sets a specific transport that is designed for each case. The transports are where the signing is either done or not done. As you can see by my transport config below, I DKIM sign webmail and smtp auth, but not forwarders:

  debug_print = "Transport: remote_smtp_authenticated for $local_part@$domain"
  driver = smtp
  max_rcpt = 10
  hosts_max_try = 2
.include_if_exists /etc/exim/dkim_transports.conf

  debug_print = "Transport: remote_smtp_webmail for $local_part@$domain"
  driver = smtp
  max_rcpt = 10
  hosts_max_try = 2
.include_if_exists /etc/exim/dkim_transports.conf

  debug_print = "Transport: remote_smtp_forwarder for $local_part@$domain"
  driver = smtp
  max_rcpt = 10
  hosts_max_try = 2

The dkim_transports.conf simply sets all the dkim_* settings using a series of macros specifically designed for my site:

CentOS58[root@ivwm51 exim]# more dkim_transports.conf
  dkim_domain = DKIM_DOMAIN
  dkim_selector = DKIM_SELECTOR
  dkim_private_key = DKIM_PRIVATE_KEY

You can model yours similarly.

share|improve this answer
Thanks. I don't understand how the "router that detects forwarded email" works. My forwarding is done by the redirect router; but I can't specify a transport there, nor is that really the right place for it. Can you show the configuration for the router that directs to remote_smtp_forwarder? – Andrew Oct 25 '12 at 16:45
I know this one is really old, but I came across this with the same question as @Andrew in mind, so I want to post what I found out: For me it helped to use the following condition in the router: condition = ${if eq{${lc:$sender_address_domain}}{$qualify_domain}} This is only true if the mail is sent by a local user. These are the cases when I want DKIM, in all other cases, I don't want DKIM. – fabstab Aug 12 '14 at 22:19

I just check the authenticated_sender variable when setting the dkim_domain.

dkim_domain = ${if def:authenticated_sender {DKIM_DOMAIN}}

This includes both SMTP authenticated clients and local users.

You could put that condition around any of the mandatory DKIM options, including dkim_domain, dkim_selector or dkim_private_key.

You could also build a more complex setup where the selector differs depending on whether the mail was locally generated, from an authenticated client, or forwarded. That way you could have different reputation for the three kinds of mail origins.

For example to use a separate key for authenticated/local vs. forwarded messages:

dkim_selector = ${if def:authenticated_sender {authenticated}{forwarded}}
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.