I have OpenDKIM installed on CentOS. I am using postfix as MTA and dovecot for IMAP/POP3.

Now the problem is am trying to setup DKIM for my domain. The mails are send from a sub domain mail.example.com. The issue is that mails are not being signed and the /var/log/maillog has no signature table match for test@mail.example.com. Could anyone please help me solve this?

This is the content of KeyTable file

default._domainkey.mail.example.com  mail.example.com:default:/etc/opendkim/keys/mail.example.com/default.private

This is the signingtable content file

*@mail.example.com default._domainkey.mail.example.com

This is the TrustedHosts content file

127.0.0.1
example.com
mail.example.com
  • 1
    What's the SigningTable line in your opendkim.conf look like? The "*@domain" form only works for regular expression files, for example. – user206988 Jan 27 '14 at 14:31
  • in config i have : SigningTable refile:/etc/opendkim/SigningTable – Amal Jan 27 '14 at 15:00
  • in config i have : SigningTable refile:/etc/opendkim/SigningTable – Amal Jan 29 '14 at 7:33
up vote 7 down vote accepted

Thanks to all who tried to help.. The issue was a bug with refile in opendkim when there is CR character in Signingtable file.. So, i saved the file in non DOS format to remove the CR character and it worked perfect...

The trusted hosts setting is ip addresses or networks. To my knowledge, putting hostnames in there isn't going to do anything for you. You put the IP addresses of any hosts which will source email to your server that you want it signed, and the key/signing table entries determine if the sender domain warrants it.

The format of your signing table looks correct, and the format of your key table looks correct. I suspect that once you fix your trusted hosts list, it will fix your problem.

Added content Jan 27:

How you specify the signing table in your opendkim.conf controls how the file is processed. Since you are using "*@example.com" in your signing table, you need to tell opendkim that it should expect and handle wildcard characters. The way to do this in opendkim is to prepend "refile:" to the configuration directive. Without that "refile:" portion, it expects an exact match for the email address. Make sure it looks like this:

SigningTable  refile:/etc/opendkim/signing_table

Added content Jan 31:

Also make sure that your Mode is set to "sv" (for sign and verify) and not just "v" (verify only, the default).

  • Thanks for answer... But i added the ip to trusted hosts and still its the same... This is the error that i get... Jan 26 10:42:03 server opendkim[16897]: 9B0DF1F80173: no signing table match for 'test@mail.mydomain.com' Jan 26 10:42:04 server opendkim[16897]: 9B0DF1F80173: no signature data – Amal Jan 26 '14 at 7:45
  • in config i have : SigningTable refile:/etc/opendkim/SigningTable – Amal Jan 27 '14 at 14:59
  • It's possible that opendkim is not using the configuration file you think it is. Locate all opendkim.conf files and make sure that you are editing the correct one. – Todd Lyons Jan 31 '14 at 17:24
  • I rechecked and the config file loaded is correct... I done a opendkim-testkey -vvv -d mail.domain.com -s email -k /etc/opendkim/keys/mail.domain.com/default.private And it results in key okay... I have also checked the dns txt record and its also okay(i think opendkim-testkey does dns check too).... But when i send a mail and check the /var/log/maillog its no signature table match! – Amal Feb 1 '14 at 10:10

We can use dos2unix (use : apt-get install dos2unix if not installed) as a filter to remove CR and other special char :

dos2unix < /etc/opendkim/signing_table

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.