Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm signing email just fine, but I don't want to sign relayed email when the "From" address is one of the domains I'm signing.

What's the right way to configure Postfix/OpenDKIM to sign only from these sources?

  • localhost
  • traffic via the submission port (which only allows SASL-authenticated sources)
  • backup MX servers (authenticated with relay_clientcert)

I can imagine a solution by installing two instances of OpenDKIM, one for a verifying pipeline and another for signing, but I'm hoping there's a simpler and more direct solution.

share|improve this question
    
Do you use opendkim for verifying DKIM signature too? –  masegaloeh Jul 15 at 1:17
    
Yes. I can imagine a solution by installing two instances of DKIM, one for a verifying pipeline and another for signing, but I'm hoping there's a better solution. –  danorton Jul 15 at 14:31
    
I'm confused with your sentences I don't want to sign relayed email when the "From" address is one of the domains I'm signing. Could you elaborated it? –  masegaloeh Jul 16 at 4:01

1 Answer 1

A strong caveat - I haven't done this, but it's what I'd try first.

You should probably start by making sure your sending MUAs don't use port 25. eg require that submissions be made on ports 465 or 587. You should configure things such that mail received on port 25 is never relayed outwards.

You can then configure the master.cf file such that 'submission' is handled differently than 'smtp'. Those entries can include many of the settings you'd otherwise put in the main.cf file, and I'm thinking you could set smtpd_milters and/or non_smtpd_milters in the master.cf file.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.