Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My web hosting server features a Postfix setup up and running. That postfix is also open with STARTTLS on port 587 for authorized users (only me, myself and I right now) to send emails to any domain after signing it with DKIM.

Every email I send via Outlook authenticating myself is fine. All DMARC reports display no error. The problem is when web applications send email via that Postfix.

Since I use Apache's mod-itk for PHP hosting, all emails are generated by and submitted to Postfix via standard means (sendmail???).

But in that way they are not DKIM-signed. Consider the following:

$ mail
Subject: Test DKIM

Port25 responded:

DomainKeys check details:
Result:         neutral (message not signed)
ID(s) verified:
DNS record(s):

DKIM check details:
Result:         neutral (message not signed)
ID(s) verified: 

Postfix logs don't show dkimproxy interaction.

Before posting my configuration, let's repeat the situation and ask the question.

Currently, when I send an email via SMTP/TLS on port 587 it gets DKIM-signed. When a process on the server sends an email using mail command or PHP builtin mail function, the mail dorsn't get signed by dkimproxy.

The question is: how to sign every email coming from the server itself with dkimproxy?

Configuration is pasted to Please note that I have only dkimproxy.out enabled for the moment

share|improve this question
up vote 2 down vote accepted

You added dkim SIGNING to submission port only.

Postfix handles smtp separatly submission from pickup (mails submited by sendmail command are entering postfix via pickup)

In postfix You should use dkim milter in

smtpd_milters = inet:localhost:10027
non_smtpd_milters = inet:localhost:10027

First line is for SMTP submission (port 587)

Second line is for mails entering via pickup

One thing to note is that bounce messages and NDR reports generated internally by postfix will not be DKIM signed


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.