36
votes
Accepted
Can't change OpenDKIM socket in Debian stretch in /etc/default/opendkim
I finally found the solution.
The /etc/init.d/opendkim doesn't seem to do anything. But instead the servicefile /lib/systemd/system/opendkim.service is used which had the wrong socket hardcoded.
But ...
- 671
18
votes
Is _ (underscore) illegal in a CNAME record?
Hostnames may only contain [0-9], [a-z], -, so the underscore is not valid in a hostname. Note that a TXT record is not a hostname, and this restriction doesn't apply for it. (- may not be used as the ...
- 98k
10
votes
Accepted
Connect to Milter service unix:/var/run/opendkim/opendkim.sock: No such file or directory
You will need to set the socket file in spool dir of postfix, e.g:
/var/spool/postfix/var/run/opendkim
After changing that, you might see problem about permission, then just change group owner of ...
- 514
9
votes
Accepted
OpenDKIM errors
Your permissions are too restrictive.
The opendkim user/group does not have access to the /etc/ssl/private folder.
Depending on your setup it should be owned by the opendkim group, and the group ...
- 17.4k
8
votes
Accepted
postfix: milter-reject: END-OF-MESSAGE from ...: 4.7.1 Service unavailable (opendkim)
The problem, in my case, was that the signing key file had root owner, so doing:
sudo chown opendkim:mail /etc/opendkim/selector.private
Fixed the problem.
If this is not your problem, don't forget ...
- 359
7
votes
Accepted
Postfix - Opendkim - Unable to connect to local socket
Tested on my CentOS6 that postfix seems not really "chrooted".
My setting:
# /etc/opendkim.conf
Socket local:/var/run/opendkim/opendkim.sock
# /etc/postfix/main.cf
smtpd_milters = unix:/var/run/...
- 121
7
votes
Accepted
OpenDKIM not signing mail
Issues I see:
Your use of refile
From the documentation:
If the string begins with "refile:", then the remainder of the string is presumed to specify a file that contains a set of patterns, one ...
- 21.7k
6
votes
Accepted
OpenDKIM milter with Postfix
In your opendkim.conf file
Mode v
sets the operating mode to verify only, so your outgoing messages will never be signed.
This is explained in the comment right above the relevant line:
...
- 984
6
votes
Accepted
Valid DKIM signature ramdomly fails to validate
While my DKIM record is "valid", some validators won't accept h=rsa-sha256; argument in a DNS record and will render the DKIM signature as invalid. I imagine that Google is using a few diffrent linux ...
- 448
6
votes
Accepted
opendkim-testkey: key not secure
As also explained in my other answer, key not secure in this context indicates that OpenDKIM was not able to authenticate the key using DNSSEC.
You have to ensure that OpenDKIM can make use of DNSSEC. ...
- 857
6
votes
Accepted
Why doesn't dkim sign the letter?
It appears you have accidentally missed the section in the tutorial titled "Connect Postfix to OpenDKIM", which configures OpenDKIM on Unix domain sockets instead of the default TCP ...
- 2,959
5
votes
Accepted
OpenDKIM not signing outgoing mail
The problem was caused by two things:
Contrary to what the comments in opendkim.conf claim, mode = sv is not the default. I had to set it explicitly.
I made an error in my SigningTable: *.domain1.com ...
- 385
5
votes
DKIM not signing with alias addresses - not internal, not authenticated
For your concept here the ideal workflow
External email receive by postfix
OpenDKIM verifies the DKIM signature, if exists
Postfix rewrite From: header so it comes from your domain that you ...
- 18.1k
5
votes
opendkim-testkey returns "invalid data set type", while if I specify domain and selector I got "Key OK"
I've solved the problem. This thread helped:
OpenDKIM not signing mail
opendkim.conf has to have this line
KeyTable /etc/opendkim/KeyTable
(without refile:/ prefix)
This now works:...
- 579
5
votes
can I use multiple selectors for opendkim?
I have 4 domains hosted on a single server. Should I use 4 separate DKIM keys or one for all of them?
Technically you can use the same key-pair to generate DKIM signatures for all the domains you ...
- 74k
4
votes
Postfix not communicating with opendkim
Fixed it. I don't know how but I had no_milters set in /etc/postfix/master.cf in "pickup" service. It prevents postfix to send email to milter.
- 191
4
votes
Accepted
Postfix/OpenDKIM not signing PHP sent emails
When sending through the console or a mail client like Outlook or Mac's Mail it processes fully and has all three pass.
This behavior was expected because you place this configuration in main.cf
...
- 18.1k
4
votes
opendkim-testkey: key not secure, but dnssec is ok
You have to make sure that OpenDKIM is able to use DNSSEC. key not secure in this context means that OpenDKIM was not able to verify the key using DNSSEC.
For example, you can use dig to see if it ...
- 857
4
votes
Is _ (underscore) illegal in a CNAME record?
@Sven's answer, with the edit, is already right but just to phrase things directly.
TL;DR yes underscore is valid in a CNAME record on both sides, read below for why.
RFC 1034 and others define ...
- 9,721
4
votes
Accepted
Milter (opendkim): error connecting to filter: Connection refused by localhost
There's another configuration file for opendkim, /etc/default/opendkim, and that file specifies a different default socket:
# Command-line options specified here will override the contents of
# /etc/...
- 201
4
votes
opendkim error loading key
The error message is quite clear "key data is not secure:" which indicates incorrect permissions on the key file, what is confirmed by the output of your ls command:
-rwxr-xr-- opendkim opendkim ...
- 74k
4
votes
Accepted
DKIM signature failure only on CRON jobs
The authentication results done by mx.google.com imply there's something different in the respecitve body between the messages you send on the command line and the ones which are send by a cron job: "...
- 162
4
votes
Accepted
OpenDKIM generates 2 keys
You've built a 2048 bit key which won't fit in a standard TXT record. Have the DNS concatenate the two strings for you by entering them as follows:
TXT ( "first part" "second part" )
or
TXT "first ...
- 4,991
4
votes
Can I DKIM sign my email without running a server daemon just for that?
A DKIM signature isn't just "a text blob", but it has to be cryptographically calculated using a private key and the headers/body that are signed with it. Also, OpenDKIM isn't just for ...
- 44.8k
4
votes
Accepted
OpenDKIM won't start: "opendkim: milter socket must be specified"
As the error says, you should specify the socket. The mandatory configuration parameter can be found on opendkim.conf documentation:
Socket (string)
Specifies the socket that should be established by ...
- 44.8k
4
votes
Accepted
OpenDKIM reports "signing table references unknown key" (CentOS 8)
Look at:
dig default._domainkey.esfs.info. txt +short
This returns empty, which is unexpected. Instead you have it under a different name mta1:
dig mta1._domainkey.esfs.info txt +short
"v=DKIM1; ...
- 13.7k
4
votes
Accepted
How to validate opendkim generated RSA keys
You can compare the modulus of both, as follows:
Grab the public key from your DNS record. This is the string within the p=, as you say. Be aware that it is sometimes returned as two strings, which ...
- 4,294
3
votes
Accepted
openDKIM breaks email forwarding
From what I see, it appears your mails are rejected due to one of your milter failing to process postfix's commands. This is not a problem with postfix, but one of your milter not behaving properly.
...
- 998
3
votes
DKIM signing key
Your email domain.
And you should publish public key via dns
DKIM provides a method for validating a domain name identity that is associated with a message through cryptographic authentication - so,...
- 73
3
votes
Accepted
How do I modify SELinux to allow OpenDKIM to write to /var/tmp?
There is no need to allow OpenDKIM to write to any other directories. Just write to the default temporary directory, /var/run/opendkim, which should already exist and have the correct SELinux context ...
- 241k
Only top scored, non community-wiki answers of a minimum length are eligible