3

I've set up DKIM wit exim4 on my debian server. Everything is working correctly with one fixed domain, e.g. the following works perfectly fine.

DKIM_DOMAIN = example.com

Now I'm trying to change this to work with multi-domains. So I've changed this to

DKIM_DOMAIN = ${lc:${domain:$h_from}}

(other changes as well as required) - however this breaks because the actual emails are being sent from various *.example.com. So, I thought I'd use `${sg...} to strip the first part, however I'm having problem getting it right. Whatever I try results in exim spitting out this in the log:

failed to expand dkim_domain: missing } at end of string - could be header name not terminated by colon

The things are made more complicated by the fact that some of the domains are ".com" and others are ".co.uk". As a minimum, I need to cater for example.org, example.com and example.co.uk.

This is what I've got so far:

${sg{${lc:${domain:$h_from}}}{\N^.+\.(example\.(co\.uk|org|com))\$\N}{\$1}}

This again results in the above error message. Can someone please help me resolve this?

2
  • 1
    Standard form is the ` dkim_domain = ${lc:$sender_address_domain} `
    – Kondybas
    Nov 28, 2017 at 22:19
  • If it helps, my cPanel, by default, uses dkim_domain = ${lc:${perl{get_message_sender_domain}}}
    – rinogo
    Jun 18, 2018 at 21:37

1 Answer 1

3

I sign for multiple sender domains with the following configuration items. All site use the same private key. Setting the private key would be more difficult if they used different keys, but it can be done. I use the selector as the private key file name extension. It is currently 201710.

DKIM_CANON = relaxed
DKIM_DOMAIN = ${sender_address_domain}
DKIM_PRIVATE_KEY = CONFDIR/dkim.private.201710
DKIM_SELECTOR = ${extract{-1}{.}{DKIM_PRIVATE_KEY}}
DKIM_STRICT = true
DKIM_WARN = true

You will need to publish the public key in all the domains you are signing for, or the recipients won't be able to verify the signature.

I've written an article on Implementing DKIM with Exim.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .