I've installed opendkim with postfix on Debian Wheezy. Outgoing mail is getting DKIM signatures. The smtpd and non-smtpd milter spec is the same.

Incoming mail seems not to be verified - in a mail client there is no Authentication-Results header. I've added "AlwaysAddARHeader yes" to the opendkim config, but no difference.

In the mail log, on receipt of a message, among all the various entries there are two by opendkim. The first identifies the server and adds "not internal" (which seems reasonable when it is Google). The second just says "not authenticated". But I can't see any reason why it's not authenticated! Where can I look for the solution?


It looks like ,no_milters option in content filter destination prevents running milter twice - before and after content filter.

You could remove ,no_milters option. The result is as follows:

  • opendkim can now verify emails
  • milter runs twice on outgoing mail, so you have 2 dkim signatures in your mails

Should you get back ,no_milters option, opendkim can still sign emails, but loses the ability to verify them. Little tinkering with amavis showed that amavis uses the same id as opendkim does, which is not a surprise because of standards they both obey. Given that amavis replaces header opendkim added after verification (in fact it still does verify messages) with empty one so it looks like opendkim does not verify messages.

So, there are 2 ways of preventing this header from disappearing:

  1. run milter after content filter, which I believe is not possible by design
  2. prevent amavis from overwriting this header

I could not find any way to prevent milter running before amavis so as to allow it run after. However you can prevent amavis rewriting that header by redefining $myauthservid = "amavis.local"; near the end of 50-user config file. At least that's how I solved this for myself.

|improve this answer|||||

The "not authenticated" may be just because the remote mail server is not signing their messages. Not everybody out there is signing their emails with DKIM. In fact, this mechanism is not so widely implemented as it should be. That being said, the fact that you use DKIM it's going to greatly improve your mail deliverability, but don't expect that everyone sending mails to your organization use it as well. DKIM it's growing slowly in my humble opinion.

You may find interesting this DKIM deployment trends experiment.

Also, if you are sure that the remote server is signing their messages and your mail server ignores it, I suggest that you check for known bugs here.

|improve this answer|||||
  • The incoming messages I'm talking about are definitely signed - the DKIM signature is in the email header. The problem is that there isn't an Authentication-Results header added by opendkim when viewing the email in Thunderbird. Other checks done on the mail server, such as SPF, have added headers. But not DKIM. – user203826 Jan 4 '14 at 23:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.