Skip to content
IT // Adventures

OpenDKIM and Postfix

Configure OpenDKIM and integrate it into Postfix.

2 min read
Contents

While trying to sign the mails of my Postfix mail server with DKIM as simply as possible, I came across a poorly documented feature of OpenDKIM.

Since the mail server is only used for a handful of domains and a very manageable mail volume, it was important to me to keep the configuration as simple as possible. Among other things, I wanted to manage only a single key for signing all outgoing mails.

In opendkim.conf, the directives “Domain *” and “KeyFile …” assign one key to all domains. The prerequisite is of course that all domains can use the same “selector”.

Excerpt from the config:

Selector k201903 # Selector for ALL domains
Domain   *
KeyFile  /etc/opendkim/keys/k201903.private # Key for ALL domains

Here is the complete configuration, including the integration of OpenDKIM into Postfix as a milter…

Configure OpenDKIM

First, install the OpenDKIM package from the repo…

yum install opendkim

… and adjust the configuration file /etc/opendkim.conf (excerpt):

Mode     sv # s = signing (outgoing emails), v = verify (incoming emails)
Socket   inet:8891@localhost # OpenDKIM listens on port 8891, ONLY locally
Selector k201903
Domain   *
KeyFile  /etc/opendkim/keys/k201903.private

Then configure the list of TrustedHosts (note that 127.0.0.1 should always be first in the list):

127.0.0.1
::1
mail.server.com # FQDN of the mail server
mail # Hostname of the mail server
1.2.3.4 # IP address of the mail server

Generate the key

The key for signing the mails must match the “selector” (defined in opendkim.conf) and can easily be created via opendkim-genkey:

opendkim-genkey -b 2048 -h rsa-sha256 -r -s k201903 -d mail.server.com -v

This creates the key (.private) and a text file (.txt) with the public key for the DNS record in the directory /etc/opendkim/keys. The public key from the text file is needed in step 3.

Of course, the private key may only be usable by OpenDKIM itself. It is therefore advisable to set the permissions accordingly restrictive:

chown -R opendkim:opendkim /etc/opendkim
chmod go-rwx /etc/opendkim/keys

Then we (re)start the service:

service opendkim restart

Create the DKIM DNS records

On the DNS server, a TXT record named “<selector>._domainkey” now has to be created for all domains according to the following scheme:

v=DKIM1; k=rsa; p=MI[...]QAB

Here v=DKIM1 (version) and k=rsa (key) are standard values, and p= contains the public key. The public key was created with “opendkim-genkey” (see above).

Once the DNS records have been created, they can be checked for correctness with the following command:

opendkim-testkey -d Domain -s Selector -vvv

Integrate OpenDKIM into Postfix

To integrate OpenDKIM into Postfix, the milter configuration in /etc/postfix/main.cf has to be adjusted and the service restarted:

milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:localhost:8891 # If other milters are already in use, e.g.
non_smtpd_milters = inet:localhost:8891 # ClamAV, separate the entries with commas