I found this site. But if I use it, doesn't it mean that port25.com would know and be able to use my private key?
3 Answers
You can use that to generate a sample configuration, but should use openssl to generate your real keys.
\\ Generate a private key
openssl genrsa -out domainname.com.key 1024
\\ Generate a public key
openssl rsa -in domainname.com.key -out rsa.public -pubout -outform PEM
After running those you'll have two files:
# lc
total 3
-rw-r--r-- 1 chris chris 887B Jun 5 15:51 domainname.com.key
-rw-r--r-- 1 chris chris 272B Jun 5 15:51 rsa.public
With contents like:
# cat *
-----BEGIN RSA PRIVATE KEY-----
MIICWwIBAAKBgQC7aa4feMEPMy5NXPvaMAPvboFkQqRqCVTMnMeSr4L4oqvd7nou
06nozt6nLtQZnA/KBLDy0ypq2ewTv5te+He5UIDW+VWoaHgZV1FXtfl5f12Ne4bO
FVk8XwaIKBJQgtA5iJKoBGxg4A2VoCwxUdW9+LukTtAlFANPdvyCnMsVDQIDAQAB
AoGACGnAFU2YbRRBGdv4uly5cIAnctbDBreQhPbsxpr2aC71RCs2dO+vivHucNbb
UqL82nbHcr8kAlPyExjg4qyIw0c8JC8AgPKQulmH8K5F1sIFuaJT/3ey/syjT7MS
uKmoCtT5XoagTCOiOpclhCA9ixtFjg4+dlkQiLgEXQq8rgkCQQDgC3v8fh3lbiXB
fkuE1IaP1mJRwnb1QfZdAa3zM+rk2gG15C1/VYTb4tzscddHcU2/yJ3XOjCBXkMp
2LMVkQ43AkEA1iSnz1woQ+TNn7gN6euaXaXT+Aap/ZeqSCTYQjuG0vrf2Ub5Nw04
m143GmWpa4fS08eTczCeHtZRWAJ6gVV02wJAaScatyPeFjt/PvRur1YsHcBJ/wOd
X3jpDzflk5rPaT+kw+DnNbdGlwlAFT1NA/v6uMOIyWZHM8CxFyfczYd6OwJAW0cu
nG284AvENiN/EsmRd/96VcuJZAXk2HGUGM9EzeOPzQ66peOl0Fwdgsv4plQz4n+8
cyozDBPwgmI0E7L4ZwJAWFloVLmfMK7S6JF3ADN5Pze9R64Uv84Y5nIpWbyDU6RQ
+T7EHSqk7+ajlNetb/6atX4SXK0AK39QjOiOpF9MSw==
-----END RSA PRIVATE KEY-----
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7aa4feMEPMy5NXPvaMAPvboFk
QqRqCVTMnMeSr4L4oqvd7nou06nozt6nLtQZnA/KBLDy0ypq2ewTv5te+He5UIDW
+VWoaHgZV1FXtfl5f12Ne4bOFVk8XwaIKBJQgtA5iJKoBGxg4A2VoCwxUdW9+Luk
TtAlFANPdvyCnMsVDQIDAQAB
-----END PUBLIC KEY-----
Yes, if you use their wizard and add the DKIM record it provides they will have all they need to send validly signed mail from your domain.
In general, something strange is going on if someone else is providing you with what is supposedly your private key.
From my point of view, port25.com having that wizard makes them look unprofessional, possibly even suspicious. Even if you trust them (maybe you have a business relationship with them?), they deliver the keys to you in the plain over the Internet.
port25.com
is asking you to provide a DomainKey Selector (e.g., key1)
- which is NOT the same as private key that you generated using openssl
or some other tools.
To make it easier, try use more native tools instead: DKIM Core Tools
- Generate a DKIM Core Key
- Check a published DKIM Core Key
- Check a DKIM Core Key Record
DKIM Core Technical Specification covers following:
1. Create the selector and associated key pair
2. Publish the public key
3. Attach the token to the email
3.1 Find the body hash
3.2 Find the header hash
3.2 Generate the DKIM-Signature header
3.3 Multiple Tokens
-
After I enter domain and selector, it gives me private/public pair. Is it safe to use them on my actual site?– ironicJun 5, 2014 at 16:12
-
Yes it is, if you so concert about that you can always go route that @chris-s described (assuming you're technical enough) or you can use tools that provided by DKIM team for everyone to use in order to simplify process.– alexusJun 5, 2014 at 16:18
-
But if I use the keys which they give me, what would stop them(except reputation concerns, and the fact that this is a useless thing to do) if they want use the private key to sign a message on my behalf?– ironicJun 5, 2014 at 16:24
-
@ironic if it'll help you sleep better and the fact that you think so highly about people who invented
DKIM
and created tools to make YOUR life easier, go ahead and generate it locally; Technology wise it'll work exactly the same, no difference, also keep in mind DKIM folks can't just use that certificate on it's own, you also need to make some DNS changes and they have no control over it, only domain owners have that kind of access.– alexusJun 5, 2014 at 16:33 -
1-1 No, if you use that Port25's website they will have your private key. Did you even look at the site he linked to? There's a big difference between "I don't think they keep the keys" and "I can guarantee nobody else has your keys".– Chris SJun 5, 2014 at 18:13