1

I have a assignment in school to setup bind9, postfix, spf, dkim and dovecot on the same machine for the address mcduckcorp.duckburg.cali on a Debian 9 OS.

I have managed to setup bind9, postfix and dovecot so that I can send and recieve mail but the dkim setup creates a problem. Whenever I try sending mail I get the error in sudo service opendkim status:

opendkim[1097]: 1EBD854249B: external host www.mcduckcorp.duckburg.cali attempted to send as mcduckcorp.duckburg.cali

also when checking the recieved mail with the mail command I have the following error in the header of the mail:

Authentication-Results: mail.mcduckcorp.duckburg.cali; dkim=permerror (bad message/signature format)

The content of the /etc/opendkim.conf file is:

Syslog          yes
UMask           007
Domain                  mcduckcorp.duckburg.cali 
KeyFile         /etc/opendkimkeys/private.key
Selector        mail
SubDomains      yes
Socket          inet:12345@localhost
PidFile               /var/run/opendkim/opendkim.pid
OversignHeaders     From
TrustAnchorFile       /usr/share/dns/root.key
UserID                opendkim

The file /etc/default/opendkim contains:

RUNDIR=/var/run/opendkim
SOCKET=inet:12345@localhost
USER=opendkim
GROUP=opendkim
PIDFILE=$RUNDIR/$NAME.pid
EXTRAAFTER=

The file /etc/postfix/main.cf contains:

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no
append_dot_mydomain = no
readme_directory = no
compatibility_level = 2

smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

smtpd_relay_restrictions = permit_mynetworks reject_unauth_destination permit_sasl_authenticated check_policy_service unix:private/policy-spf
smtpd_recipient_restrictions = permit_mynetworks reject_unauth_destination permit_sasl_authenticated check_policy_service unix:private/policy-spf
myhostname = mail.mcduckcorp.duckburg.cali
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = mcduckcorp.duckburg.cali
mydestination = $myhostname, mcduckcorp.duckburg.cali, localhost
relayhost = 
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = 192.168.55.6
inet_protocols = all
relay_domains = mcduckcorp.duckburg.cali

# DKIM
milter_default_action = accept
milter_protocol = 2
smtpd_milters = inet:localhost:12345
non_smtpd_milters = inet:localhost:12345

# SPF
policy-spf_time_limit = 3600s

The file /etc/postfix/master.cf contains:

pickup    unix  n       -       y       60      1       pickup
cleanup   unix  n       -       y       -       0       cleanup
qmgr      unix  n       -       n       300     1       qmgr
tlsmgr    unix  -       -       y       1000?   1       tlsmgr
rewrite   unix  -       -       y       -       -       trivial-rewrite
bounce    unix  -       -       y       -       0       bounce
defer     unix  -       -       y       -       0       bounce
trace     unix  -       -       y       -       0       bounce
verify    unix  -       -       y       -       1       verify
flush     unix  n       -       y       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       y       -       -       smtp
relay     unix  -       -       y       -       -       smtp
showq     unix  n       -       y       -       -       showq
error     unix  -       -       y       -       -       error
retry     unix  -       -       y       -       -       error
discard   unix  -       -       y       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       y       -       -       lmtp
anvil     unix  -       -       y       -       1       anvil
scache    unix  -       -       y       -       1       scache
maildrop  unix  -       n       n       -       -       pipe
  flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
uucp      unix  -       n       n       -       -       pipe
  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)

ifmail    unix  -       n       n       -       -       pipe
  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp     unix  -       n       n       -       -       pipe
  flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix  -   n   n   -   2   pipe
  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman   unix  -       n       n       -       -       pipe
  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
  ${nexthop} ${user}

policy-spf  unix  -       n       n       -       -       spawn
     user=nobody argv=/usr/bin/policyd-spf

The file /etc/bind/named.conf.local conatins:

zone "cali" {
  type master;
  file "/etc/bind/zones/cali.db";
};

zone "duckburg.cali" {
  type master;
  file "/etc/bind/zones/duckburg.cali.db";
};

zone "mcduckcorp.duckburg.cali" {
  type master;
  file "/etc/bind/zones/mcduckcorp.duckburg.cali.db";
  //auto-dnssec maintain;
  inline-signing yes;
};

zone "55.168.192.in-addr.arpa" {
  type master;
  file "/etc/bind/zones/55.168.192.in-addr.arpa.db";
};

and the /etc/bind/named.conf.options file contains:

options {
    directory "/var/cache/bind";
    forwarders {
      192.168.55.5;
    };
    auth-nxdomain no;    # conform to RFC1035
    listen-on-v6 { any; };
};

the file /etc/bind/zones/mcduckcorp.duckburg.cali.db contains:

@ IN SOA ns1.mcduckcorp.duckburg.cali. mail.mcduckcorp.duckburg.cali. (
        2018101100  ;serial
        86400       ;refresh
        7200        ;retry
        3600000     ;expiration
        172800)     ;minimum

@ IN NS ns1.mcduckcorp.duckburg.cali.
ns1.mcduckcorp.duckburg.cali. IN A 192.168.55.5

www IN  A   192.168.55.5
mail    IN  A   192.168.55.6

squirrel    IN  CNAME   www

mcduckcorp.duckburg.cali.   IN  MX  10 mail.mcduckcorp.duckburg.cali.

mail._domainkey     IN  TXT ( "v=DKIM1; h=sha256; k=rsa; t=y; "
      "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr5UWdHzwwL/gki26JF+y9t/8VUfY9wb2hAwX825D2q4hnIEMFzZSKDyvug7+D19nDp7f1VQ4x2JFvVVVwMwanaB3WHmlsLa9AItFv5yL2i6b1RrXdgFiezJt22K/TNvkjGohxnGsC/7lHIvlkN4Em4Zok/eoquWg294b05I+4vR3TWf2PbxxPgYKR0D9ahtkA632asGAMG0gRh"
      "m8Xw2hPSk6LT0QHWdPM0iw20WZJdZflhjsByIj1BWL+L/TetnCOORwfz6A9T/+L0zQUodpJNKyYbnZ6Wxac4n6pnaiO99znUlKuQDuhyDfSbqLqi9it5Rise6FryhL1YBf5USGtwIDAQAB" )  ; ----- DKIM key mail for mcduckcorp.duckburg.cali

mcduckcorp.duckburg.cali. IN TXT "v=spf1 mx ~all"
mcduckcorp.duckburg.cali. IN SPF "v=spf1 mx ~all"

I have searched for the error

dkim=permerror (bad message/signature format)

online but haven't been able to find anything that seems related at the moment..

  • I think the domain key format is actually wrong. the comment should not be in there as well es the braces (though I'm not quite sure whether that is bind syntax) – Christopher Perrin Oct 17 '18 at 13:29
  • I am quite sure now. Only the values inside the braces should be in your bind config. – Christopher Perrin Oct 17 '18 at 13:31
  • you mean in the "/etc/bind/named.conf.options" file that the comment should be removed? – Payerl Oct 17 '18 at 13:49
  • Yes. it shoudl something like mail._domainkey IN TXT "v=DKIM1; h=sha256; k=rsa; t=y; " "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr5UWdHzwwL/gki26JF+y9t/8VUfY9wb2hAwX825D2q4hnIEMFzZSKDyvug7+D19nDp7f1VQ4x2JFvVVVwMwanaB3WHmlsLa9AItFv5yL2i6b1RrXdgFiezJt22K/TNvkjGohxnGsC/7lHIvlkN4Em4Zok/eoquWg294b05I+4vR3TWf2PbxxPgYKR0D9ahtkA632asGAMG0gRh" "m8Xw2hPSk6LT0QHWdPM0iw20WZJdZflhjsByIj1BWL+L/TetnCOORwfz6A9T/+L0zQUodpJNKyYbnZ6Wxac4n6pnaiO99znUlKuQDuhyDfSbqLqi9it5Rise6FryhL1YBf5USGtwIDAQAB" – Christopher Perrin Oct 18 '18 at 7:11
  • I removed the comment but it still does not work.. – Payerl Oct 18 '18 at 9:04

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.