I'm signing email just fine, but I don't want to sign relayed email when the "From" address is one of the domains I'm signing.
What's the right way to configure Postfix/OpenDKIM to sign only from these sources?
- traffic via the submission port (which only allows SASL-authenticated sources)
- backup MX servers (authenticated with relay_clientcert)
I can imagine a solution by installing two instances of OpenDKIM, one for a verifying pipeline and another for signing, but I'm hoping there's a simpler and more direct solution.