Skip to main content
37 votes
Accepted

Can't change OpenDKIM socket in Debian stretch in /etc/default/opendkim

I finally found the solution. The /etc/init.d/opendkim doesn't seem to do anything. But instead the servicefile /lib/systemd/system/opendkim.service is used which had the wrong socket hardcoded. But ...
lw1.at's user avatar
  • 691
18 votes

Is _ (underscore) illegal in a CNAME record?

Hostnames may only contain [0-9], [a-z], -, so the underscore is not valid in a hostname. Note that a TXT record is not a hostname, and this restriction doesn't apply for it. (- may not be used as the ...
Sven's user avatar
  • 99.6k
12 votes
Accepted

postfix: milter-reject: END-OF-MESSAGE from ...: 4.7.1 Service unavailable (opendkim)

The problem, in my case, was that the signing key file had root owner, so doing: sudo chown opendkim:mail /etc/opendkim/selector.private Fixed the problem. If this is not your problem, don't forget ...
Chazy Chaz's user avatar
10 votes
Accepted

Connect to Milter service unix:/var/run/opendkim/opendkim.sock: No such file or directory

You will need to set the socket file in spool dir of postfix, e.g: /var/spool/postfix/var/run/opendkim After changing that, you might see problem about permission, then just change group owner of ...
HVNSweeting's user avatar
8 votes
Accepted

opendkim-testkey: key not secure

As also explained in my other answer, key not secure in this context indicates that OpenDKIM was not able to authenticate the key using DNSSEC. You have to ensure that OpenDKIM can make use of DNSSEC. ...
glts's user avatar
  • 916
7 votes
Accepted

OpenDKIM not signing mail

Issues I see: Your use of refile From the documentation: If the string begins with "refile:", then the remainder of the string is presumed to specify a file that contains a set of patterns, one ...
Gerald Schneider's user avatar
6 votes
Accepted

Valid DKIM signature ramdomly fails to validate

While my DKIM record is "valid", some validators won't accept h=rsa-sha256; argument in a DNS record and will render the DKIM signature as invalid. I imagine that Google is using a few diffrent linux ...
Solrac's user avatar
  • 458
6 votes

can I use multiple selectors for opendkim?

I have 4 domains hosted on a single server. Should I use 4 separate DKIM keys or one for all of them? Technically you can use the same key-pair to generate DKIM signatures for all the domains you ...
HBruijn's user avatar
  • 80.4k
6 votes
Accepted

OpenDKIM generates 2 keys

You've built a 2048 bit key which won't fit in a standard TXT record. Have the DNS concatenate the two strings for you by entering them as follows: TXT ( "first part" "second part" ) or TXT "first ...
Mikael H's user avatar
  • 5,099
6 votes

OpenDKIM ignoring hostnames and domains in trusted hosts file

This was resolved by removing the leading asterisks from a domain wildcard in /etc/opendkim/trusted.hosts. The asterisks being there not only stopped the domain wildcard from working but also stopped ...
Bunny's user avatar
  • 101
6 votes
Accepted

Why doesn't dkim sign the letter?

It appears you have accidentally missed the section in the tutorial titled "Connect Postfix to OpenDKIM", which configures OpenDKIM on Unix domain sockets instead of the default TCP ...
Paul's user avatar
  • 3,167
5 votes

opendkim-testkey returns "invalid data set type", while if I specify domain and selector I got "Key OK"

I've solved the problem. This thread helped: OpenDKIM not signing mail opendkim.conf has to have this line KeyTable /etc/opendkim/KeyTable (without refile:/ prefix) This now works:...
Mladen Adamovic's user avatar
5 votes

opendkim error loading key

The error message is quite clear "key data is not secure:" which indicates incorrect permissions on the key file, what is confirmed by the output of your ls command: -rwxr-xr-- opendkim opendkim ...
HBruijn's user avatar
  • 80.4k
4 votes

opendkim-testkey: key not secure, but dnssec is ok

You have to make sure that OpenDKIM is able to use DNSSEC. key not secure in this context means that OpenDKIM was not able to verify the key using DNSSEC. For example, you can use dig to see if it ...
glts's user avatar
  • 916
4 votes

Is _ (underscore) illegal in a CNAME record?

@Sven's answer, with the edit, is already right but just to phrase things directly. TL;DR yes underscore is valid in a CNAME record on both sides, read below for why. RFC 1034 and others define ...
Patrick Mevzek's user avatar
4 votes
Accepted

Milter (opendkim): error connecting to filter: Connection refused by localhost

There's another configuration file for opendkim, /etc/default/opendkim, and that file specifies a different default socket: # Command-line options specified here will override the contents of # /etc/...
Jeff Kaufman's user avatar
4 votes
Accepted

Postfix extremely slow, lot of mail in maildrop

The problem was caused by the library opendkim, even if in the documentation is stated that it should rely on /etc/resolv.conf (and its been like that as long as I can remember), in my case it was ...
Strae's user avatar
  • 487
4 votes
Accepted

DKIM signature failure only on CRON jobs

The authentication results done by mx.google.com imply there's something different in the respecitve body between the messages you send on the command line and the ones which are send by a cron job: "...
cora's user avatar
  • 182
4 votes

Can I DKIM sign my email without running a server daemon just for that?

A DKIM signature isn't just "a text blob", but it has to be cryptographically calculated using a private key and the headers/body that are signed with it. Also, OpenDKIM isn't just for ...
Esa Jokinen's user avatar
  • 49.9k
4 votes
Accepted

OpenDKIM won't start: "opendkim: milter socket must be specified"

As the error says, you should specify the socket. The mandatory configuration parameter can be found on opendkim.conf documentation: Socket (string) Specifies the socket that should be established by ...
Esa Jokinen's user avatar
  • 49.9k
4 votes
Accepted

OpenDKIM reports "signing table references unknown key" (CentOS 8)

Look at: dig default._domainkey.esfs.info. txt +short This returns empty, which is unexpected. Instead you have it under a different name mta1: dig mta1._domainkey.esfs.info txt +short "v=DKIM1; ...
kubanczyk's user avatar
  • 14k
4 votes
Accepted

How to validate opendkim generated RSA keys

You can compare the modulus of both, as follows: Grab the public key from your DNS record. This is the string within the p=, as you say. Be aware that it is sometimes returned as two strings, which ...
garethTheRed's user avatar
  • 4,844
4 votes

How destination mail server can know the DKIM selector

It's contained in the DKIM header. Example: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=default; This corresponds to the txt record under the following DNS record: ...
Gerald Schneider's user avatar
3 votes
Accepted

Opendkim doesn't sign emails sending from external clients

It sounds like you want to trust and sign messages from possibly any address. In this case you can add ranges to the TrustedHosts file, adding 0.0.0.0/0 will accept and sign from all IPs.
alaphoid's user avatar
3 votes
Accepted

How do I modify SELinux to allow OpenDKIM to write to /var/tmp?

There is no need to allow OpenDKIM to write to any other directories. Just write to the default temporary directory, /var/run/opendkim, which should already exist and have the correct SELinux context ...
Michael Hampton's user avatar
3 votes

Postfix - Opendkim - Unable to connect to local socket

For those that find this and the issue is not resolve with the above answers, my issue was group execute permissions missing on the opendkim socket folder /var/run/opendkim/ I added a cron @reboot ...
Jacob Evans's user avatar
  • 8,006
3 votes
Accepted

How can I test the DKIM configuration of my server (Postfix + OpenDKIM)?

Apparently the test at the site I linked has a problem, so, I found two ways to test my config (SSL, SPF, DKIM and DMARC): Using gmail. Simply send an email to some account of yours in gmail, and ...
The Quantum Physicist's user avatar
3 votes

Tons of OpenDKIM Issues

Are you postfix is chrooted ? If not the socket paths don't match. Maybe try on a local tcp port, usually opendkim setup for 8891, so change smtpd_milters = inet:127.0.0.1:8891 non_smtpd_milters = ...
Sandor Marton's user avatar
3 votes

RSPAMD + DKIM Signing: How to be able to use a single DKIM Key for multiple domains?

To make it easier for people stumbling over the same question. Here is an example on how to use the key - and signing table, mentioned in the comments above, so that you can sign every from domain and ...
mat1010's user avatar
  • 131
3 votes

What's the right way to enter DKIM string into BIND zone file?

One thing that makes it hard to tell what exactly was going on in your situation is how the question only includes the tail end of the record data (including a trailing "), but the beginning of ...
Håkan Lindqvist's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible