1

I'm sending mails from my debian server with sendmail. I want to be able to send mail with multiple domains using masquerading with genericstable. I am signing the mails with OpenDKIM but because OpenDKIM signs the mail before masquerading happens the keys don't match.

OpenDKIM addresses this problem on their README page

Due to the way the milter protocol is incorporated into the MTA, opendkim sees the headers before they are modified as required by those two features. This means the DKIM signature is generated based on the headers originally injected by the mail client and not on the headers which are actually sent out by the MTA. As a result, the verifying agent at the receiver's side will be unable to verify the signature as the signed data and the received data don't match.

The suggested solutions to this problem are:

(1) Send mail with the headers already written as needed, obviating the need for these features (or just turn them off).

(2) Have two MTAs set up, either on separate boxes or on the same box. The first MTA should do all of the rewriting (i.e. use these two features) and the second one should use opendkim to add the signature and do no rewriting at all.

(3) Have multiple DaemonPortOptions lines in your configuration file. The first daemon port (port 25) does the header rewriting and then routes the message to the second port; the latter does no rewriting but does the signing and then sends the message on its way.

I want to use the 3rd solutions to fix the problem but I can't figure out how to start. For reasons I do not want to use the first solution.

My current DeamonPortOptions in my sendmail.mc file are

DAEMON_OPTIONS(`Family=inet,  Name=MTA-v4, Port=smtp')dnl
DAEMON_OPTIONS(`Family=inet,  Name=MSP-v4, Port=submission, M=Ea')dnl

Is it possible to set my sendmail to use 1 port for masquerading and another for adding DKIM and sending like the README suggests?

Any help would be greatly appreciated!

2
  • Can you elaborate on what you need help on? The configuration file in question is generally /etc/mail/sendmail.mc. What DaemonPortOptions entry do you currently have there?
    – Mike B
    Feb 26, 2015 at 8:14
  • @MikeB I updated my question for you
    – Sandman
    Feb 26, 2015 at 8:24

1 Answer 1

0

I was able to solve this problem by adding the Masquerading features and settings in my submit.mc/submit.cf configurations. That way the local mail program (MSP) changes the From: header before it is sent to the DKIM milter by the MTA.

I used the same MASQUERADE_AS and MASQUERADE_DOMAIN lines as I have in sendmail.mc

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .