0

My webserver is hosted on Amazon EC2, on free tier, on say example.com. As i'm only using a single elastic ip address, and i don't want to pay for another, i thought about setting up postfix on my webserver rather then setting it up on mail.example.com (which is probably a better idea).

Most documents talk about adding these records to a subdomain, but can i put it on my main domain as well (i.e. example.com). I currently set my SPF as a TXT on my main domain and it passes SPF checks. Can i do the same for DKIM?

I just generated a key on https://www.unlocktheinbox.com/dkimwizard/ and it shows the private and public key, and below selector record and policy record.

While i understand where i need to put my private (postfix) and public key (in the dns txt/mx record) but not sure where i should add my 2 generated records (selector and policy). Can i add them both as TXT records under my main domain rather then having to create a subdomain (i.e. mail.example.com) ?

Your Selector Record:

rsa._domainkey.example.com IN TXT

"k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnfOc9CYLS2I2/mSaDbRoZyJzlHYrS5aSjU3U94FKDmGUkG7HqLUFWRx6TkZVQ5JpKoyTA25PUpBnzdu11945B66EbrZGAYb3YE7kCJ1BSNjaXajd4fzkFfYV06riJgWC83wBc9hoIoDzAZDNFV/HKstjy8Zd2H81HnvpVGnuKeAQsKIdIyazYwv85kHwh8tRm0si4I251VJ9dHByoMu+/e/s8ppBhvaH0Ss1YZr5B7q8PVeoy6V+l9JMPkKt+wsELTBBKVk7LLYdiis3bHXaYL0cfjPerqfwkyX2Hq2xdSUZ90zw7W6pvsoFDVe/1H45ZbqkLJ8klz8YLzwPAJj13wIDAQAB"

Your Policy Record:

_domainkey.example.com IN TXT "o=~"

Thank you.

Improve this question

1 Answer 1

Reset to default
1

No, you can't. You must have exactly as said in all the documentation and tutorials, i.e.

selectorname._domainkey.example.com. IN TXT "k=ra;P=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB...

Here, the _domainkey comes from DKIM specification (RFC 6376, 7.5) and selectorname is the selector (3.1) for identifying multiple signing keys from each other. While the selector is user-defined and could be anything, it must be the same than used in the s= tag in the signature:

DKIM-Signature a=rsa-sha1; q=dns; d=example.com; [email protected]; s=selectorname; ...

This will cause searching for the public key from DKIM Namespace (3.6.2.1), which is a subdomain.

All DKIM keys are stored in a subdomain named _domainkey. Given a DKIM-Signature field with a d= tag of example.com and an s= tag of foo.bar, the DNS query will be for foo.bar._domainkey.example.com.

This is just defined this way and it just differs from the SPF records that are defined (RFC 7208, 3) to be placed in the DNS tree at the owner name it pertains to, not in a subdomain under the owner name.

The _domainkey.example.com. IN TXT "o=~" was originally designed for providing information on signing policy in DKIM Sender Signing Policy Internet-Draft, where o=~ would specify that the entity signs some but not all mail, while - and ! would be more strict and . for not sending mail at all.

This was never actually used, so you don't need _domainkey.example.com IN TXT "o=~" at all.

For the real-life substitute of o= you should orientate towards DMARC. Without DMARC it's not possible to tell whether a domain uses DKIM or not; you could only check if DKIM passes whenever it is present, but it doesn't cover messages without the signature header.

A DMARC policy allows a sender to indicate that their messages are protected by SPF and/or DKIM, and tells a receiver what to do if neither of those authentication methods passes – such as junk or reject the message.

When implementing DMARC you should already have both SPF and DKIM working.

Improve this answer
12
  • But i specified a selectorname (rsa). Your answer doesnt really tell me why i cannot use it without a subdomain. Could you elaborate? (and keep it simple please :-). I don't understand why i can't use it on a toplevel domain. My SPF record works on my toplevel domain. Surely more people then me combined both mail and http on the same server? And are you saying i should not use DKIM at all, but use DMARC instead?
    – ATv
    May 18, 2017 at 11:58
  • alternatively if i have to use a subdomain, i suppose i could create a mail subdomain as an A record and point it to my domain.com ip address, as i have with my www. record. although i'd prefer if people didn't end up on my webserver when going to mail.domain.com
    – ATv
    May 18, 2017 at 12:01
  • Of course you can use rsa as a selector name, it could be yourmother. I just had to change it in my example in order to distinguish it from other uses of rsa, because it's also also used in signature algorithm name (a=rsa-sha1).
    – Esa Jokinen
    May 18, 2017 at 12:33
  • DKIM records are all text records (TXT), not address mapping records (A). They are not resolving to any IP. Therefore, you are not creating any new subdomains, just adding the DKIM information in the standard (and only) way. I also clarified the DMARC part of my answer.
    – Esa Jokinen
    May 18, 2017 at 12:47
  • 1
    Hi Esa! I was hung up that they are not A records, but TXT records. So the protocols just need a TXT record defined. I kept the SPF record under my maindomain.com, and i added dkim and dmarc under my subdomains, and a mx record to boot. Thank you for your explanation, it sure helps.
    – ATv
    May 19, 2017 at 16:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .