10

I have OpenDKIM installed on CentOS. I am using postfix as MTA and dovecot for IMAP/POP3.

Now the problem is am trying to setup DKIM for my domain. The mails are send from a sub domain mail.example.com. The issue is that mails are not being signed and the /var/log/maillog has no signature table match for [email protected]. Could anyone please help me solve this?

This is the content of KeyTable file

default._domainkey.mail.example.com  mail.example.com:default:/etc/opendkim/keys/mail.example.com/default.private

This is the signingtable content file

*@mail.example.com default._domainkey.mail.example.com

This is the TrustedHosts content file

127.0.0.1
example.com
mail.example.com
Improve this question
3
  • 1
    What's the SigningTable line in your opendkim.conf look like? The "*@domain" form only works for regular expression files, for example.
    – user206988
    Jan 27, 2014 at 14:31
  • in config i have : SigningTable refile:/etc/opendkim/SigningTable
    – Amal
    Jan 27, 2014 at 15:00
  • in config i have : SigningTable refile:/etc/opendkim/SigningTable
    – Amal
    Jan 29, 2014 at 7:33

4 Answers 4

Reset to default
10

Thanks to all who tried to help.. The issue was a bug with refile in opendkim when there is CR character in Signingtable file.. So, i saved the file in non DOS format to remove the CR character and it worked perfect...

Improve this answer
1
7

The trusted hosts setting is ip addresses or networks. To my knowledge, putting hostnames in there isn't going to do anything for you. You put the IP addresses of any hosts which will source email to your server that you want it signed, and the key/signing table entries determine if the sender domain warrants it.

The format of your signing table looks correct, and the format of your key table looks correct. I suspect that once you fix your trusted hosts list, it will fix your problem.

Added content Jan 27:

How you specify the signing table in your opendkim.conf controls how the file is processed. Since you are using "*@example.com" in your signing table, you need to tell opendkim that it should expect and handle wildcard characters. The way to do this in opendkim is to prepend "refile:" to the configuration directive. Without that "refile:" portion, it expects an exact match for the email address. Make sure it looks like this:

SigningTable  refile:/etc/opendkim/signing_table

Added content Jan 31:

Also make sure that your Mode is set to "sv" (for sign and verify) and not just "v" (verify only, the default).

Improve this answer
7
  • Thanks for answer... But i added the ip to trusted hosts and still its the same... This is the error that i get... Jan 26 10:42:03 server opendkim[16897]: 9B0DF1F80173: no signing table match for '[email protected]' Jan 26 10:42:04 server opendkim[16897]: 9B0DF1F80173: no signature data
    – Amal
    Jan 26, 2014 at 7:45
  • in config i have : SigningTable refile:/etc/opendkim/SigningTable
    – Amal
    Jan 27, 2014 at 14:59
  • It's possible that opendkim is not using the configuration file you think it is. Locate all opendkim.conf files and make sure that you are editing the correct one.
    – Todd Lyons
    Jan 31, 2014 at 17:24
  • I rechecked and the config file loaded is correct... I done a opendkim-testkey -vvv -d mail.domain.com -s email -k /etc/opendkim/keys/mail.domain.com/default.private And it results in key okay... I have also checked the dns txt record and its also okay(i think opendkim-testkey does dns check too).... But when i send a mail and check the /var/log/maillog its no signature table match!
    – Amal
    Feb 1, 2014 at 10:10
  • 1
    Thanks for saving my day. ("v" vs. "sv").
    – Viktor Toth
    Apr 18, 2021 at 1:24
0

We can use dos2unix (use : apt-get install dos2unix if not installed) as a filter to remove CR and other special char :

dos2unix < /etc/opendkim/signing_table
Improve this answer
0

I just had this same error on Debian 11.2 and was missing the refile: on the signing key file entry in the /etc/opendkim.conf file. This is the correct entry that fixed the issue.

SigningTable    refile:/etc/mail/dkim.signingtable
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .