I host a few websites on my vps server - gentoo linux + postfix + php.
Each website has a dedicated user (for example to run php) called website_com (something_co_uk, address_eu, etc), so the full address of each website is firstname.lastname@example.org
When anybody sends mail from php, the sender is email@example.com, which is not surprising. Each mail has a proper Reply-To header, which points to something like firstname.lastname@example.org, email@example.com, etc.
I have dovecot lmtp configured, so each website has its own accounts separate from system accounts - that also works great.
The hosting domain (hosting.com) and all websites has SPF records allowing A and MX, so the SPF is passed.
Now the key question.
I want to configure opendkim, so all mails sent from firstname.lastname@example.org would be properly signed for domain website.com
Now - for which address should I configure signing? For 'From' address, or for 'Reply-To' address? Or maybe for both?
Which domain should I add the TXT record to? The hosting.com or the website.com?
And also: does opendkim somehow check incoming emails? I also have spamassasin which seems to perform the DKIM checking, I don't want them to collide.