3

I am trying to setup an DKIM email signing for a postfix SMTP server.

This server is to be used by different services on the local network.

I have generated DKIM key pair, added it to my domain and was able to successfully send emails out from the server itself as seen here:

me@server:~$ telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 server.lan ESMTP Postfix (Ubuntu)
HELO example.com
250 server.lan
MAIL FROM: [email protected]
250 2.1.0 Ok
RCPT TO: [email protected]
250 2.1.5 Ok
DATA
354 End data with <CR><LF>.<CR><LF>
To:[email protected]
Subject:Testing from server

hello
.
250 2.0.0 Ok: queued as AAD604EA1CC2

That message is received with the correct DKIM signature.

But, if I do the exact same (only with telnet server.lan 25) thing on another machine on the local network, the DKIM signature is not included and the recipient doesn't know who sent the email.

I have found that this entry in /var/log/mail.log is relevant to it:

Jul 30 04:28:16 server opendkim[25664]: AAD604EA1CC2: can't determine message sender; accepting

So I have figured that postfix is not setting the FROM address properly. So why is it not doing it and how can I fix it?

Thanks in advance...

The entire log during transaction from the workstation is this:

Jul 30 15:56:29 server postfix/smtpd[6795]: warning: database /etc/aliases.db is older than source file /etc/aliases
Jul 30 15:56:29 server postfix/smtpd[6795]: connect from workstation.lan[192.168.1.63]
Jul 30 15:57:24 server postfix/smtpd[6795]: 2C35E4EA1DD1: client=workstation.lan[192.168.1.63]
Jul 30 15:58:18 server postfix/cleanup[6799]: 2C35E4EA1DD1: message-id=<>
Jul 30 15:58:18 server opendkim[25664]: 2C35E4EA1DD1: can't determine message sender; accepting
Jul 30 15:58:18 server postfix/qmgr[25810]: 2C35E4EA1DD1: from=<[email protected]>, size=272, nrcpt=1 (queue active)
Jul 30 15:58:19 server postfix/smtp[6802]: 2C35E4EA1DD1: to=<[email protected]>, relay=ASPMX.L.GOOGLE.COM[173.194.70.26]:25, delay=67, delays=66/0.02/0.26/1.1, dsn=2.0.0, status=sent (250 2.0.0 OK 1343656739 a59si1127667wel.70)
Jul 30 15:58:19 server postfix/qmgr[25810]: 2C35E4EA1DD1: removed
2

5 Answers 5

2

The MTA is never responsible for setting message headers; this is a problem with your mail client or MUA.

That said, if postfix detects a message without ANY From: headers, it adds the MAIL FROM sender address as a From: header; this is very well documented.

2
  • The only thing that remotely resembles an MUA or mail client here is telnet. Surely telnet cannot be blamed for anything going wrong. I have posted the entire transaction with the MTA. No if postfix usually adds the From: automatically into the DATA block, why not in this case? And why is it still not signed when I add that header myself? Jul 30, 2012 at 13:28
  • Please include the entire log of one of these tests; that will show conclusively what happens.
    – adaptr
    Jul 30, 2012 at 13:39
1

I just ran into this issue and solved it. They key here is the line from the maillog: "can't determine message sender; accepting". The issue is that the mail coming in is malformed and is missing some RFC-required headers that opendkim needs in order to do DKIM.

By default, opendkim is configured to allow these messages through, since it's unable to do anything with the available information and can neither confirm nor deny that the message passes DKIM, and errs on the side of caution with it deciding not to drop messages unless explicitly configured to.

Why this is being triggered when you send mail using telnet is because you didn't type out all the RFC-required headers that opendkim was expecting. If you added them in (specifically, opendkim only seems to check for the From and Date headers, and doesn't seem to care at all what the Date header actually contains)

If you're okay with dropping all mail that violates RFCs and is missing those From or Date headers, you can go into your opendkim.conf and either change or add the line "RequiredHeaders yes". It's probably fairly safe to do this as even most spam gets all this right, but there's always a risk when dropping mail that some legitimate mail might also get dropped.

1

Probably many people stumble upon this while testing their freshly installed Postfix by manually interacting with SMTP server over telnet, and once authenticated they do something like that:

...
mail from: [email protected]
250 2.1.0 Ok
rcpt to: [email protected]
250 2.1.5 Ok
data
354 End data with <CR><LF>.<CR><LF>
Hi there
this is just a basic test message
.
250 2.0.0 Ok: queued as 2E7FB27F

which results in "dkim=permerror (bad message/signature format)" seen on the receiving end, and negative spam score points due to that.

It may be not clear from the other responses, so I'll reiterate this in bold and plain English: it is your responsibility to add From: in your data section in order for DKIM to trigger! That is, your message must contain From: (ideally also To: and Subject:, but this is less important):

...
mail from: [email protected]
250 2.1.0 Ok
rcpt to: [email protected]
250 2.1.5 Ok
data
354 End data with .
From: [email protected]
To: [email protected]
Subject: Test
Hi there
this is just a basic test message
.
250 2.0.0 Ok: queued as 2E7FB27F
0

Do you have both smtpd_milters and non_smtpd_milters set in your main.cf?

I tried an dkim milter with just smtpd_milters pointing to it and it wouldn't work, even though I was telnetting to smtpd, but when I added the configuration for non_smtpd_milters it started to work. Something very screwy there, but that's what made it go.

0

Add this to postfix configuration:

always_add_missing_headers = yes

local_header_rewrite_clients = permit_mynetworks permit_sasl_authenticated permit_inet_interfaces

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .