2

I would like to set up a DKIM record for outgoing emails from a forums server running on Ubuntu, but need to figure out how to do it. This is a non-standard server (e.g. not Postfix, not SendMail, not Exchange, not a cPanel setting, no PHP is involved, not WordPress). In particular, I'm not using Ubuntu's email system. I'm using the SMTP server in my own forums software.

I am able to modify the server code to add extra email headers as needed, but have been unable to figure out all the pieces required in searching.

From what I've read here and there, I understand I need a public key and a private key, but there are details I don’t understand.

  1. I used a key generator I found in a Google search to generate DKIM public and private keys for the domain. Does it matter which key generator I use to obtain the public and private keys?
  2. I need to add a DKIM header to the outgoing mail headers. I can add headers to my outgoing mails, but I don’t know the format of this header.
  3. I need to add at least one TXT record to the DNS, but I don’t know the format for a DKIM record. In this case a sub-domain will be sending the email.
  4. I think, but am not sure, that I need to have the public or private key readable somewhere on my server for validation. Is that so? That part is completely vague to me.

Can someone answer these points. I believe if I understand what the generic pieces are I can put them together, unless specialized software is required to manage the DKIM record.

1 Answer 1

3

To get DKIM implemented you need the following components:

  1. The software that will sign you messages (specific to your particular Mail Transfer Agent)
  2. Private key configured in this software (can be generated in pair with Public Key with any tool available)
  3. Public key added to your public DNS following a DKIM syntax

Your MTA signs the message with the private key, which has to be protected from external access. Receiving clients check the signature validity with the Public Key you have published in DNS.

Please see this article. Even though it targets Exchange environment it explains the basics of DKIM and DMARC(you will probably want this as well!) in pretty detail.

TechNet: On-Premises Exchange: DKIM and DMARC setup

This is an example software that works with Exchange to do the signing

5
  • By signing our messages, do you mean adding a special DKIM header to each outgoing email? If so, what is the format of this header? Also, if that header is the private key, how can that be protected from external access? Won't it become part of the email sent to all recipients? I will also take a look at your links to see if they provide enough generic info. Thanks. Jul 27, 2017 at 13:15
  • @DougLerner You add the special DKIM header, yes, but that has to be calculated by the signing software. It consists of the signature and parameters that were used to generate the signature, such as the fields of an email that are protected with this signature. You wouldn't usually bother with exact syntax of the header, because it is automated with software you install to handle DKIM signing. As to access protection, I meant the actual private key. If somebody were to acquire it, they would be able to sign the messages on your behalf. Jul 27, 2017 at 13:18
  • That is useful additional information. It sounds like I need to find special software to generate the DKIM header. I'm not sure where to look for that. If such software is available in JavaScript, for example, I could add it to my server. Is each signature calculated separately for each email sent? Or is it one signature for the domain? Jul 27, 2017 at 13:23
  • @DougLerner It is per message. I use the above mentioned Exchange "plug-in". If you don't find a JavaScript DKIM signer, you might succeed implementing an SMTP relay that would just do the signing for you. I'm sure there should be options for postfix\exim or any other opensource MTA, but unfortunatelly, I don't know any particular products. Jul 27, 2017 at 13:26
  • I found this source which might be suitable for calculating signatures - gist.github.com/tanguylebarzic/2198497. It creates a DKIM-Signature: header using various parameters. That makes sense. Thanks. Jul 27, 2017 at 13:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .