I am trying to setup an DKIM email signing for a postfix SMTP server.

This server is to be used by different services on the local network.

I have generated DKIM key pair, added it to my domain and was able to successfully send emails out from the server itself as seen here:

me@server:~$ telnet localhost 25
Connected to localhost.
Escape character is '^]'.
220 server.lan ESMTP Postfix (Ubuntu)
HELO example.com
250 server.lan
MAIL FROM: service@example.com
250 2.1.0 Ok
RCPT TO: me@example.com
250 2.1.5 Ok
354 End data with <CR><LF>.<CR><LF>
Subject:Testing from server

250 2.0.0 Ok: queued as AAD604EA1CC2

That message is received with the correct DKIM signature.

But, if I do the exact same (only with telnet server.lan 25) thing on another machine on the local network, the DKIM signature is not included and the recipient doesn't know who sent the email.

I have found that this entry in /var/log/mail.log is relevant to it:

Jul 30 04:28:16 server opendkim[25664]: AAD604EA1CC2: can't determine message sender; accepting

So I have figured that postfix is not setting the FROM address properly. So why is it not doing it and how can I fix it?

Thanks in advance...

The entire log during transaction from the workstation is this:

Jul 30 15:56:29 server postfix/smtpd[6795]: warning: database /etc/aliases.db is older than source file /etc/aliases
Jul 30 15:56:29 server postfix/smtpd[6795]: connect from workstation.lan[]
Jul 30 15:57:24 server postfix/smtpd[6795]: 2C35E4EA1DD1: client=workstation.lan[]
Jul 30 15:58:18 server postfix/cleanup[6799]: 2C35E4EA1DD1: message-id=<>
Jul 30 15:58:18 server opendkim[25664]: 2C35E4EA1DD1: can't determine message sender; accepting
Jul 30 15:58:18 server postfix/qmgr[25810]: 2C35E4EA1DD1: from=<service@example.com>, size=272, nrcpt=1 (queue active)
Jul 30 15:58:19 server postfix/smtp[6802]: 2C35E4EA1DD1: to=<me@example.com>, relay=ASPMX.L.GOOGLE.COM[]:25, delay=67, delays=66/0.02/0.26/1.1, dsn=2.0.0, status=sent (250 2.0.0 OK 1343656739 a59si1127667wel.70)
Jul 30 15:58:19 server postfix/qmgr[25810]: 2C35E4EA1DD1: removed

The MTA is never responsible for setting message headers; this is a problem with your mail client or MUA.

That said, if postfix detects a message without ANY From: headers, it adds the MAIL FROM sender address as a From: header; this is very well documented.

  • The only thing that remotely resembles an MUA or mail client here is telnet. Surely telnet cannot be blamed for anything going wrong. I have posted the entire transaction with the MTA. No if postfix usually adds the From: automatically into the DATA block, why not in this case? And why is it still not signed when I add that header myself? – d_inevitable Jul 30 '12 at 13:28
  • Please include the entire log of one of these tests; that will show conclusively what happens. – adaptr Jul 30 '12 at 13:39

I just ran into this issue and solved it. They key here is the line from the maillog: "can't determine message sender; accepting". The issue is that the mail coming in is malformed and is missing some RFC-required headers that opendkim needs in order to do DKIM.

By default, opendkim is configured to allow these messages through, since it's unable to do anything with the available information and can neither confirm nor deny that the message passes DKIM, and errs on the side of caution with it deciding not to drop messages unless explicitly configured to.

Why this is being triggered when you send mail using telnet is because you didn't type out all the RFC-required headers that opendkim was expecting. If you added them in (specifically, opendkim only seems to check for the From and Date headers, and doesn't seem to care at all what the Date header actually contains)

If you're okay with dropping all mail that violates RFCs and is missing those From or Date headers, you can go into your opendkim.conf and either change or add the line "RequiredHeaders yes". It's probably fairly safe to do this as even most spam gets all this right, but there's always a risk when dropping mail that some legitimate mail might also get dropped.


Do you have both smtpd_milters and non_smtpd_milters set in your main.cf?

I tried an dkim milter with just smtpd_milters pointing to it and it wouldn't work, even though I was telnetting to smtpd, but when I added the configuration for non_smtpd_milters it started to work. Something very screwy there, but that's what made it go.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.