I have had a lot of fun with OpenDKIM - it is actively running on my Debian box and here is my code:

root@web1:~# tail -f /var/log/syslog | grep -i dkim
Sep  7 16:35:38 web1 sm-mta[1504]: 087FZbYw001504: Milter insert (1): header: DKIM-Signature:  v=1; a=rsa-sha256; c=simple/simple;\n\td=web1.mydomain.com; s=web1; t=1599492938;\n\tbh=+j1V4TFBmUGM3frMlslpv/49yjR0n44tuVimZHHRn0Q=;\n\th=Date:To:From:Reply-To:Subject:From;\n\tb=Z1gNvmXGQZXdx3iXGDpAWsdROt8iBctCrf248LQWtpNq5D3803fEWgUWCo9Bi81Bx\n\t qpE3hKokZTfD3jHlmyuhV9kZMulxEVv+jcjBXaK5r2L4957mUYW4Ao+UgBycqM6jt9\n\t CuOE+YStbaWal5mNNtf0NplJCHbHYk25NTV1y2zs=

However when I test the signature using https://www.appmaildev.com/en/dkim I am getting DKIM-Result: permerror (no key)

From the result of the tail I believe Opendkim isn't being passed the necessary to,from,reply-to etc but thats just my guess. Why would the email not be signed?

This is my /etc/opendkim.conf but I'm unclear where I would see any extra details such as the "LogWhy" should generate.

Syslog                  yes
UMask                   007
Socket                  inet:8891@localhost
PidFile               /var/run/opendkim/opendkim.pid
OversignHeaders         From
TrustAnchorFile       /usr/share/dns/root.key
UserID                opendkim
Domain                web1.mydomain.com
KeyFile               /etc/opendkim/web1.private
Selector              web1
LogWhy                  yes

So to be clear - my question is: Why is the email not being signed with DKIM?

TXT record for corresponding domain (dig TXT web1._domainkey.mydomain.com):

web1._domainkey.mydomain.com. 1799 IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDNa5dPxaE/o8nwuYd8H+qN2zfxC+5H4Y6iHCYFd0mhMLyy3fMOUoR5rEccu+cDDtv1OP9r3ko17c5K+nKenxghYbZKoRQfZu+OO6qKz+Q5PODSpWlfugXJDBDcwxcNM+k8A4zXwohBFFddpZINZ7nAnpqNqYLxrEjutwpIfjbZIwIDAQAB"

MXtoolbox reports for web1 and mydomain.com the records are setup correctly.

Line added to sendmail.mc INPUT_MAIL_FILTER(opendkim', S=inet:8891@localhost')

  • Just running a dkim service is not enough. Did you configure your MTA to actually use it? – Gerald Schneider Sep 7 '20 at 15:46
  • Did you configure your DNS with the DKIM key? The message looks like the email is signed correctly but the key could not be validated from the DNS. – tater Sep 7 '20 at 15:50
  • Yes I set the Sendmail parameters as required - the SOCKET variable and masquerade as – Antony Sep 7 '20 at 16:09
  • If there is any way I could debug it further I'd appreciate any direction. – Antony Sep 7 '20 at 16:25
  • Show the TXT record you created in DNS for it. – tater Sep 7 '20 at 16:28

The issue was in fact that I was running on a subdomain but testing against the full domain when running dig.

The full command should have been:

dig TXT web1._domainkey.web1.mydomain.com @

Which would have shown there was no key and required a discussion with my IPS to check what had gone wrong.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.