I'm trying to get DKIM setup on a CentOS 7 server running exim but gmail is returning

dkim=neutral (bad format) header.i=@ellie-oli.com;
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ellie-oli.com; s=mail;
h=; bh=VAgC5MVP54VmvlcGQaMT2ZdmokXkhMKi/RNSpcUu2qw=;

my exim config looks like

  debug_print = "T: remote_smtp_dkim for $local_part@$domain"
  driver = smtp
  hosts_avoid_tls = REMOTE_SMTP_HOSTS_AVOID_TLS
dkim_domain = ${lookup{$sender_address}lsearch*@{/etc/exim/dkim_senders}}
dkim_selector = mail
dkim_private_key = /etc/exim/dkim/mail.pem
dkim_canon = relaxed
dkim_strict = false
dkim_sign_headers = DKIM_SIGN_HEADERS

The DNS record appears to work as far as I can tell and returns as

mail._domainkey.ellie-oli.com   text = "v=DKIM1\; k=rsa\; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzo9rv2QgABArrAwPgeR++q3Y/0HGWqoETE3N7/o3hwYBMpujcPM22Lp0PoMYStu/VyyZikM23nEnmlpeOiS8GdGL0ZbP5HatDqvZKoiu5mx5PODtea8XWoKsH1BV2ngOWt0d43SRMSCBT5vJ9tJpjYe20B3lE2XEXHbrxZ5vWajvAi3vFFJ4mQSUKisQ+KV+NEt" "pqR9bm9KTk0HbeykdSwjvsz78eHCbJQUI+C9sn5MrKmdatqHOHA1fjf6iqbc7kdA08MGr3KoiySAFrPqRLR/Pw1oRueU8ImPIzY3n2ZvZqMl2zTDhe/luxf6ecCEj0AbfwbGghRxMq4QIZDvzFwIDAQAB"

Does anyone have any idea what might be causing the problems?

  • Shouldn't the 3rd field of your DKIM record start with p= ? – eranga Jun 21 '16 at 10:15
  • You are correct, I have fixed it but unfortunately am still seeing problems, different DKIM-Signature now though. I will edit the main post. – Oliver Hills Jun 21 '16 at 10:39

The signed header fields (the h-tag) in the DKIM signature is empty. According to the RFC 6376 it must however contain at least one header name. The recommended header fields to sign are described in section 5.4 of the RFC.

Probably the DKIM_SIGN_HEADERS variable contains something invalid. dkim_sign_headers according to the Exim specification:

OPTIONAL: When set, this option must expand to (or be specified as) a colon-separated list of header names. Headers with these names will be included in the message signature. When unspecified, the header names recommended in RFC4871 will be used.


It turns out I shouldn't have had the below enabled as well as a mis configuration in the DNS record pointed out by eranga

dkim_sign_headers = DKIM_SIGN_HEADERS

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.