I have postfix, dovecot, opendkim and postsrsd installed. I am trying to forward mail from alias@example.com to myemail@gmail.com, and have them signed with DKIM.

I use postsrsd in order for the SPF record to pass for the forwarded emails.

However, when I send an email from my icloud account to alias@example.com, the message is delivered to my gmail inbox, but it is not being signed by DKIM.

Here is an output of my log:

postfix/smtpd:      connect from st11p01im-asmtp001.me.com[]
postfix/smtpd:      BC23640B53: client=st11p01im-asmtp001.me.com[]
postsrsd:           srs_forward: <myicloudemail@icloud.com> rewritten as <SRS0=zgyz=HT=icloud.com=myicloudemail@hostname.myemailserver.com>
postfix/cleanup:    BC23640B53: message-id=<6fd8e885-4be1-4a37-983f-3d6f18f3b73a@me.com>
opendkim:           BC23640B53: st11p01im-asmtp001.me.com [] not internal
opendkim:           BC23640B53: not authenticated
opendkim:           BC23640B53: no signature data

I have looked at http://seasonofcode.com/posts/setting-up-dkim-and-srs-in-postfix.html and all my configuration files appear to be correct.

From what I have seen online, the "not internal, not authenticated" message means that the domain is not present in /etc/opendkim/TrustedHosts, but the domain being listed in the logs (st11p01im-asmtp001.me.com) is not my domain. I believe me.com belongs to Apple.

Is DKIM signing with an alias address using SRS not possible?

Having disabled postsrsd in /etc/postfix/main.cf, the problem still persists. Therefore, the issue is not with postsrsd, but with opendkim not signing mail for aliases addresses.

I think this is because opendkim looks at the original hostname that send the mail, which in my case is st11p01im-asmtp001.me.com, and therefore does not sign it because this address is not listed in /etc/opendkim/TrustedHosts.

Is there any way to get opendkim to work with alias addresses?

  • You shouldn't sign an email received from the outsider. – masegaloeh Jul 13 '15 at 4:13
  • 1
    @masegaloeh Could you please explain why? Sometimes the forwarded mail ends up in the spam folder of the final recipient. I am trying to avoid this. I would have assumed that signing the mail with DKIM would help towards this. – user2370460 Jul 13 '15 at 8:35
  • 1
    From technical perspective, you need to rewrite From: header instead of envelope sender (as DKIM has no interest in envelope parts). Yes you can do the rewriting with postsrsd. Unfortunately by default, rewriting was occured after signing, so it's useless. – masegaloeh Jul 13 '15 at 11:08
  • 2
    Another argument is the server who responsible signing email is the one who sent it. If you forwarding email who already has DKIM signature, then you don't need to re-sign it again. – masegaloeh Jul 13 '15 at 11:13

For your concept here the ideal workflow

  1. External email receive by postfix
  2. OpenDKIM verifies the DKIM signature, if exists
  3. Postfix rewrite From: header so it comes from your domain that you controlled, for example example.com
  4. OpenDKIM re-sign DKIM into rewritten email (and remove the original DKIM signature if exists).
  5. Postfix deliver it into aliases address.

Unfortunately, postfix and OpenDKIM doesn't support DKIM signing right before sending to final destination. OpenDKIM only support milter interface that only operates when postfix receives email. Yes, you can have workaround like postfix multi instance so the first instance will do rewriting and the second one will do signing, but I think it's not worth in your case.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.