DKIM, Sendmail, on Debian
Install & Configure
#aptitude install opendkim opendkim-tools
|
Generate Keys:
#mkdir /etc/mail/opendkim /etc/mail/opendkim/keys
#cd /etc/mail/opendkim/keys
#opendkim-genkey -t -s default -d fml.ro
At this point you should have a “default.private” and “default.txt” file in your current working directory (which is /etc/mail/dkim-milter/keys). default.txt contains the DNS TXT record you must add to your DNS entries. Here’s what it will look like:
default._domainkey IN TXT "v=DKIM1; g=*; k=rsa; p=MIGfMA0GCSqGSIb..." ; ----- DKIM default for test
|
You’ll also need to set up one more TXT record:
_domainkey IN TXT "t=y; o=~;"
|
The t=y line lets consumers know you are in test mode, and o=~ denotes that some (but not all) of your emails will be signed. When you’re done testing be sure to remove t=y (and set o=- if you so desire).
Next let’s rename and chown the private key so dkim-milter can use it.
mv default.private default
chown opendkim:opendkim default
|
Now we’ll need to edit /etc/mail/opendkim/keys/keylist to add a line like this (substituting your domain):
*@whatever-your-domain-is.com:whatever-your-domain-is.com:/etc/mail/dkim-milter/keys/default |
Milter Configuration:
/etc/opendkim.conf:
Domain
If a KeyList is used (as it is in this example), is not necessary to be specify this option; the signing-domain entries in the KeyList file infer the domains.
If you plan on only a single domain, set the value of this option to the name of the domain and omit the KeyList parameter.
Domain <yourdomain>
InternalHosts
This option specifies hosts (typcially on the local network) whose emails should be signed rather than verified. If an MTA is sitting behind this copy of sendmail (for example an Exchange server), that has this sendmail configured as its smart host, then those hosts need to be listed in this file. The localhost (127.0.0.1) should always be listed in this file.
Again, I recommend setting it to a file under the dkim-milter directory, such as /etc/mail/dkim-milter/internalhosts and remember to set the appropriate permissions.
not set
KeyList
The KeyList option specifies where to find the list of private keys for all the domains whose emails are to be signed. I recommend using /etc/mail/dkim-milter/keys/keylist and setting the permissions appropriately. Refer to the following section for the contents of this file.
If only a single domain is to be used, this option can be omitted and the Domain and Selector options used in its place.
KeyList etc/mail/dkim-milter/keys/keylist
KeyFile /etc/mail/dkim-milter/keys/default
MTA
Other sites have specified setting this value to MSA; I have left it alone. This limits which emails to sign based on the specified MTA; I choose to not limit signing based on the MTA.
MTA MTA, MSA, TLSMTA
Selector
If a KeyList is used (as it is in this example), is not necessary to be specify this option; the keypath entries in the KeyList file infer the selector per domain.
If you plan on only a single domain, set the value of this option to the name of the selector and omit the KeyList parameter. In this example, the selector should be set to nov2010.
Selector default
Socket
Many of the examples listed on various web pages specify a TCP port to use for communication. I have chosen to use a Unix domain socket that is created when the milter is started. By default the socket is created at /var/run/dkim-milter/dkim-milter.sock so the the value for this option is local:/var/run/dkim-milter/dkim-milter.sock. Again, note this dkim-filter daemon is not listening to requests on a TCP port in this example.
Socket inet:8891@localhost
Syslog
Make sure to set this to yes so that you can verify it is working. You may also choose to set the LogWhy parameter to yes to see more debugging information.
Syslog Yes
LogWhy yes (disable once everything is ok)
SyslogSuccess
Again, set this to yes to confirm the process has performed successfully. It is very useful in determining what has occurred. The output of the messages from the daemon will b written to the tail end of the /var/log/maillog file.
SyslogSuccess yes (disable once everything is ok)
UserID
Set this to the user that was created during the package installation: dkim-milter. This will ensure the dkim-filter daemon runs as that user and has limited access to other system files.
UserID dkim-milter
ADSP*
The following two options are used to make the MTA accountable to the ADSP TXT records. These are optional and can be left alone.
- ADSPDiscard yes
- ADSPNoSuchDomain yes
We’re all set configuring dkim-milter. Let’s restart it. In Debian it is configured it to start at boot.
systemctl start dkim-milter.service
systemctl enable dkim-milter.service
Sendmail Configuration
cd /etc/mail
/etc/mail/sendmail.mc:
INPUT_MAIL_FILTER(`dkim-filter', `S=inet:8891@localhost')dnl
#m4 sendmail.mc>sendmail.cf
#systemctl restart sendmail.service