Questions tagged [dkim]

DomainKeys Identified Mail is a scheme for signing and verifying email messages to confirm that that the source hasn't been forged, and is typically implemented by MTAs. The source MTA adds a header to the message body containing a signature, and the destination MTA verifies this signature against a key retrieved from DNS.

Filter by
Sorted by
Tagged with
0 votes
0 answers
31 views

Your DKIM signature is not valid - opendkim

I'm running postfix server with few "features" like spf, dmarc and DKIM. SPF and DMARC works fine and when I sent an email to my gmail account I see they PASS, however DKIM shows "FAIL&...
3 votes
1 answer
311 views

How to get SPF alignment to pass DMARC for a subdomain?

I have the following DNS configuration: $ dig +noall +answer -t txt example.com example.com. 626 IN TXT "v=spf1 +a +mx include:sendgrid.net include:_spf.google.com -all" $ dig +noall +...
0 votes
0 answers
52 views

This relay isn't allowed to send mail "From" gmail.com

I'm on GoDaddy and since about January 2024, I've been getting this message from various gmail and yahoo accounts: ECDHE-RSA-AES256-GCM-SHA384:256 CV=yes: SMTP error from remote mail server after end ...
10 votes
2 answers
17k views

How do I use OpenDKIM with multiple domain names on a single server?

How do I use OpenDKIM with multiple domain names on a single server? I own 3 domain names, and I have a single server that's running postfix for sending email. How do I use OpenDKIM? Can I use the ...
2 votes
4 answers
738 views

How destination mail server can know the DKIM selector

It is possible to set a "subdomain" in DKIM DNS record name. This "subdomain" is called a selector. It allows to have multiple DKIM keys for the same domain. There is something I ...
46 votes
5 answers
77k views

Find DKIM and DMARC Records?

Is there a method to find a domain's DKIM and DMARC records using dig or nslookup? I have attempted to do the following: dig somedomain.org any returns many records, but not the known DKIM and ...
6 votes
4 answers
12k views

Is it possible to find a list of all DKIM keys for a domain?

a DKIM-record is identified by its selector, which might be default, dkim or something else alltogether (and there might be multiple). When making sure that an e-mail's content is valid, the DKIM ...
-1 votes
1 answer
51 views

Phishing email but with SPF, DKIM and DMARC in "PASS" status

I received an email from a company that looked fine. Gmail deemed it ok. I checked the domain and the various DMARC, DKIM and SPF headers: they are all in "PASS" status. The sender's IP also ...
6 votes
4 answers
12k views

DKIM error: dkim=neutral (bad version) header.i=

Ive been struggling the last couple of hours with setting up DKIM on my Postfix/CentOS 5.3 server. It finally sends and signs the emails, but apparently Google still does not like it. The errors I'm ...
0 votes
1 answer
192 views

SPF spf.protection.outlook.com is invalid for messages within tenant

When sending mails through our Exchange 365 service those mails get through successfully, but if we look at the mail headers we see that where the sender and recipient are in our tenant the mail's ...
2 votes
0 answers
135 views

How to capture incoming emails on exchange before they reach transport agents?

I'm trying to debug why some inbound emails are failing DKIM checks. I'm running the latest version of Microsoft Exchange server 2019 on Widows Server 2022. I have enabled pipeline tracing via the ...
user avatar
0 votes
0 answers
48 views

DKIM settings with Amazon SES not finding primary domain

I'm attempting to send email via Amazon SES with a custom domain. I have one domain that works and the DKIM headers that come to my gmail account look like: Authentication-Results: mx.google.com; ...
1 vote
1 answer
119 views

Can I have more than one public keys saved in one selector for dkim?

The question is easy to understand, but it might be confusing. I understand that I can host multiple selectors for a DKIM record, but just out of curiosity, can I have multiple keys per selector in a ...
3 votes
1 answer
335 views

How to make postfix sign non-delivery notifications with DKIM?

I have set up my "postfix" server to sign outgoing messages with DKIM and verified that it works correctly for SMTP users using authentication. However, "non-delivery notifications"...
5 votes
1 answer
593 views

Is email deliverability impossible with a .name email address?

I have a dot name domain. .name is an odd TLD: they originally only offered third level domains, eg first.last.name, so that more people could get their own name. They also included the first@last....
11 votes
4 answers
7k views

record DKIM on IONOS makes sense?

If I am sending mail through SMTP, I understand that it is IONOS who signs those emails, right? I would like to add the DKIM header to my emails. I know that it is necessary to publish a CNAME record ...
0 votes
2 answers
189 views

Why does my DMARC report from Google have "<dkim>fail</dkim>" when all auth_results have "pass"

We're using Microsoft 365 (outlook.office.com) for our company emails and have had DKIM set up for a while, but recently added a DMARC record. I now got a DMARC report from Google where every record ...
0 votes
1 answer
133 views

DKIM signing - does it matter which transport agent does the signature

I am quite new to the dkim area. I understand how it works but some details, i am missing. Let's say, i have a mail server that contains user boxes (Exchange) and an edge server that just transports ...
0 votes
2 answers
207 views

Forwarding email message breaks DKIM

I have problem with postfix, DKIM and forwarding messages. In almost every article about DKIM I’m reading that “if I do not modify any fields in message header, DKIM signature should still be valid ...
3 votes
5 answers
6k views

postfix not reporting FROM address to opendkim

I am trying to setup an DKIM email signing for a postfix SMTP server. This server is to be used by different services on the local network. I have generated DKIM key pair, added it to my domain and ...
0 votes
1 answer
165 views

Original DKIM signing is not sent when using SMTP relay

We are using a VPS (ubuntu 18, postfix) to send mails for multiple domains hosted on a server (AlmaLinux 8). For example from the domain "domain.com". VPS is maildomain.com Hosting server ...
2 votes
2 answers
376 views

Add Multiple Subdomains In Signing Table And Key Table Opendkim

I need some major help adding multiple subdomains in the signing table and key table for opendkim without listing them one by one. If I have 50 subdomains I want to add, it will take me forever. I am ...
2 votes
1 answer
5k views

dkim verification keeps failing bad signature

My DKIM verification keeps failing, and I can't figure out why. It's signed though, but wrong. When I check domain and selector it turns out as valid, so problem is with signing. Here is a dump of ...
0 votes
0 answers
119 views

DKIM file not found with Rspamd and a DKIM selector map

I am running into an error with Rspamd where my dkim signing file is not being found. The exact error message is dkim_module_load_key_format: cannot load dkim key /var/lib/rspamd/dkim/mydomain.com....
0 votes
0 answers
122 views

Is possible to use a DKIM-Proxy to signing emails requested from another application?

I using an application to send emails, written in golang which use net/smtp as SMTP Libary, however that lib provide no support with DKIM signing, but using a sendmail command, for example, the DKIM ...
0 votes
1 answer
66 views

OpenDKIM not signing e-mails from host10.example.com

I have a server, called host10.example.com which sends administrative e-mails by mailx commands to myself only. These outgoing e-mails need to be signed by OpenDKIM. I have tried many configurations ...
0 votes
1 answer
123 views

What does "--[no]subdomains" option in opendkim-genkey mean?

Based on the documentation --nosubdomains "Disallows subdomain signing by this key". But didn't we need to create separate DKIM records for subdomains regardless? Please correct me if I am ...
1 vote
1 answer
128 views

How OpenDKIM decides which emails to sign?

In OpenDKIM, what domain does it consider to use when comparing to internal hosts? Do it consider the domain of Return-Path (i.e. envelope MAIL FROM's domain) or header From or HELO's domain.
1 vote
0 answers
170 views

What are typically the headers which I should oversign?

I am trying to setup MTA using Postfix and using opendkim for dkim signing. When I went through opemdkim documentation it have a field which is named 'OversignHeaders' document describes it as: "...
0 votes
0 answers
48 views

What is behaviour of opendkim while verifying an email with multiple dkim signatures?

I am trying to implement DKIM verification using Opendkim and postfix. The doubt I am struck by is what will happen if the email has more than one DKIM signature and one of them fails (as like failed ...
-1 votes
1 answer
334 views

Create a pair of keys suitable for DKIM setup using ssh-keygen

Question What is the right way to create a pair of keys suitable for DKIM setup using ssh-keygen? Given the corresponding solution with openssl: # creates a private key openssl genrsa -out sample.key ...
1 vote
1 answer
206 views

DKIM aligned but not authenticated for mailboxes moved to Exchange Online in a hybrid configuration

For mailboxes migrated to our tenant, they have this in the received message header of external recipients after migration: arc=fail (body hash mismatch); SPF/DKIM/DMARC all pass using the records ...
0 votes
2 answers
909 views

DKIM aligned but not authenticated on On-Premises Exchange 2019

I have an On-Premises Exchange 2019 server with Hybrid Deployment with Office365 configured. Everything is working as expected, but DKIM aligned messages are arriving as unauthenticated. I can confirm ...
0 votes
2 answers
87 views

Should we add SPF records of popular email providers?

DMARC is reporting that a small fraction of our emails originate from google, microsoft, and some other providers. DMARC is also reporting that a good chunk of those emails fail both SPF and DKIM, and ...
0 votes
0 answers
131 views

DMARC and Postfix delivery reports

I successfully set up DMARC, DKIM and SPF for my mailserver's domain, but delivery reports created by Postfix fail the DKIM/SPF tests. The headers of regular messages (sent via my mailserver) look ...
1 vote
0 answers
438 views

DKIM Signature Body Hash Verified to Office 365

I am checking the email header in https://mxtoolbox.com and getting the error DKIM Signature Body Hash Verified. Problem only occurs when sending emails to other Office 365 accounts. The same email ...
0 votes
1 answer
318 views

DKIM signing – duplicate header signing in DKIM-Signature

My e-mail messages are DKIM signed but I noticed that the DKIM-Signature header contains duplicated header indicators like: h=from:from:subject:subject:date:date:message-id:message-id:to:to: […] and ...
0 votes
2 answers
125 views

A Non-MX mail server + Google Workspace, is this viable?

I have a domain (example.com) configured for sending and receiving mail using Google Workspace. I need to launch additionally a separate (own) mail server. Switching completely to the new server is ...
0 votes
1 answer
504 views

Should HELO, MAILFROM and From use the same domain?

I configured a mail server a couple of times before and I believe back then I thought that the answer is "yes." But I'm about to configure another one, and it seems that I was wrong. Let's ...
0 votes
0 answers
40 views

Getting Spoofed - DMARC , DKIM and SPF are properly setup (AFIK)

I have been testing my DMARC policy for some weeks and I ran into this issue. Background: SPF - setup and working DKIM - set up and working (AFIK) DMARC - set up and working - looking for alignments ...
0 votes
0 answers
139 views

Config Wizard error in Rspamd on dkim step in Debian Bullseye

Using fresh Debian 11.7 installation I’m trying to setup RSpamd using configwizard, but in the last step of building the private key I got the following error: Do you want to create privkey /var/lib/...
0 votes
2 answers
159 views

What is the behavior of a DNS resolver if one authoritative name server does not have particular record but another one does

Say I have sent a query for TXT record for m1._domainkey.amazon.com nslookup -q=txt m1._domainkey.amazon.com Say the authoritative nameservers for amazon.com are amazon.com nameserver = ns1.amzndns....
1 vote
1 answer
227 views

Exim false negative on DKIM verification

My mailserver using exim4 has an ACL to check DKIM signatures. It accepts everything but it logs failures and writes a header with the results. I'm sending mail from another server which I believe is ...
0 votes
1 answer
3k views

How to correctly split a DKIM txt dns entry?

many questions here on spliting DKIM txt records, but my dns provider only allows 255 chars for each key. no fancy way to enter multiple values like the other platforms mentioned all the other ...
0 votes
1 answer
596 views

Do spaces in DKIM records matter?

I'm trying to get BIND show my DKIM exactly like it was generated but it seems like the " sign is messing up the results for dig. If I don't insert the public key within "" then dig ...
1 vote
3 answers
89 views

What is the difference between a query for a TXT record and a query for a TXT record against a particular name server?

For the purpose of implementing an email server, I want to be able to look up a domain's DKIM record. What is the difference between these two sets of DNS queries? Which should I choose to implement ...
0 votes
1 answer
589 views

EXIM4: Signing Emails with DKIM

I really am banging my head against the wall with this one. I have tried for serveral days to get dkim signing to work on outbound emails from a server running on Debian 12, exim4 version 4.96, but to ...
8 votes
4 answers
5k views

Should DKIM selector names be unguessable?

The M³WAAG DKIM Key Rotation Best Practices document (pdf) recommends a "sufficiently" random DKIM selector name so that it cannot be guessed by browsing the DNS. A literal quotation: 4.3 Key ...
11 votes
4 answers
24k views

Postfix - Opendkim - Unable to connect to local socket

I am getting denied errors when postfix tries to connect to the unix socket for opendkim, actual error: Sep 24 15:41:43 service-a-4 postfix/cleanup[17414]: warning: connect to Milter service unix:var/...
0 votes
1 answer
1k views

Postfix - can't send emails to gmail addresses via terminal

I have the following errors when trying to send emails to gmail addresses via my terminal: sudo tail /var/log/mail.log Jul 19 13:19:44 ubuntu-4gb-fsn1-1 postfix/cleanup[5780]: B4B8C5F4A3: message-id=&...

1
2 3 4 5
13