So, at the moment I am signing mails from specific domains using opendkim and this works. But when I try to send mails from domains that opendkim does not know, they they are not signed.

What I want to do, is to make opendkim sign all emails going through postfix using a single domain, just like mailchimp etc is doing.

Example: I am sending emails from myname@mydomain.com using mailchimp, and the signeture is something like the following:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=k1; 
d=mail2.suw13.rsgsv.net; h=Subject:From:Reply-To:To:Date:Message-ID:List-
ID:List-Unsubscribe:Sender: Content-Type:MIME-Version; 
bh=4Rla76/wHV31ER3IZqXOuA09j3OG2SuFbfD5Jc7Kn94=; b=17jmyvz05JfeNC+avqWJmtESF2A58LA/CievFVtQ0sqwo4FYKAP0Gfpjtc5LSG7tr9ntS5CziAgSOa+UyEjRP3AhZOOXDFoQMUG0gntqxg/gP074Vi7Hy0XvFzAiJYZfAhijwvaroY45hjuX+RN3nQ0xTfhWem5mv3+VVYpwvUo=

How do I achieve this?

  • You cannot achieve this at all, as DKIM has two parts to configure. opendkim is one side, the other side is to put the public keys for your domain into a DNS record. So a "catch all" configuration cannot work as opendkim does not which key to use for which domain or even if one of its keys is correct for the domain. – allo Jan 29 '18 at 15:49
  • If you want to use some automation, you can try a tool like ansible to generate opendkim configurations and DNS zonefiles for your domains. – allo Jan 29 '18 at 15:50
  • I see your point. But what am I missing? I received an email from and would like to do the same. Example: Company Support <support@company.com> via mail136-21.atl41.mandrillapp.com, and later: signed by: mail136-21.atl41.mandrillapp.com How do they achieve this? – BQffen Feb 27 '18 at 20:09

like this answer the trick lies in the use of SigningTable and KeyTable:


SigningTable    refile:/etc/mail/dkim_signing_table
KeyTable        csl:keyname=example.com:selector:/etc/mail/selector.key 


* keyname

So the SigningTable maps all domains to a key, and the KeyTable provides a domain/selector for the keyname.


In your example, the message isn't signed for your own domain, but for d=mail2.suw13.rsgsv.net, instead. MailChimp has that as their default authentication, but it recommends using Custom Domain Authentication i.e. having an own DKIM authentication for every domain.

It removes the default MailChimp authentication information ( "via mcsv.net" or "on behalf of mcsv.net") that shows up next to your campaign's From name in certain email clients.

For the same reason you shouldn't try to have a single domain for signing messages for all domains.

  • according the the sprit of the RFCs you should even try to sign each type of message in a domain with different signing domain. – danblack Aug 19 '18 at 11:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.