The nightmare began when I sent an email to a legitimate email address in France and had it bounced by gmail as having failed both the SPF and DKIM tests. Strange, because I had sent many emails to gmail addresses and never had this problem before.
I investigated and found that the failed email had been routed from my server via an intermediary French server and that gmail was concluding that the ip address of the originating server was the same as the ip address of the intermediary. Apparently, SPF will fail in such a situation. You can work round the issue by configuring SPF to include the ip of the intermediary, but who wants to do that! However, DKIM verification should have survived and I was left with the uncomfortable possibility that my OpenDKIM setup was not working properly. Viewing my mail logs I could see that opendkim was correctly examining incoming emails, passing some, failing others, as it should do, but outgoing emails were not being signed by DKIM.
If the reader is experiencing SPF, DKIM or any other mail security issues, I strongly advise them to purchase my manuals shown below. They are not expensive and will save a lot of grief. In my case, I found that I had omitted from my list of trusted hosts, as described in my manuals, the public ip address of my mail server. The issues you should check, which are described in detail in my manuals, include the postfix and opendkim configuration files and the DNS records.
Should you still have problems getting OpenDKIM to sign outgoing mails, there is an alternative which is compatible with the rspamd anti-spam software which is also featured in my manuals. Conveniently. rspamd provides an optional DKIM module.
Here are the instructions for activating it. Important: we will make use of the existing key files and DNS records we have been using for OpenDKIM. There is no need to suffer the inconvenience of generating a fresh set. To use the existing config and enrcyption files you need to add the rspamd user ( named _rspamd ) to the opendkim group with:
sudo usermod -aG opendkim _rspamd
First, deactivate OpenDKIM for outgoing emails. You can leave it in place for checking incoming mail.
In /etc/postfix/main.cf, change this line
non_smtpd_milters = unix:opendkim/opendkim.sock, unix:opendmarc/opendmarc.sock, inet:127.0.0.1:11332
to
non_smtpd_milters = unix:opendmarc/opendmarc.sock, inet:127.0.0.1:11332
That turns off OpenDKIM for outgoing emails.
Next, edit or add if it doesn't yet exist: /etc/rspamd/local.d/dkim_signing.conf
You need these settings, shown in this example for two domains. If the file already exists it may have "enabled" set to false. You must turn on the facility by setting enabled to true.
enabled = true;
use_redis = false;
selector = "default";
domain {
myexampledomain.biz {
selector = "default";
path = "/etc/opendkim/keys/myexampledomain.biz/default.private";
}
myotherdomain.org {
selector = "default";
path = "/etc/opendkim/keys/myotherdomain.org/default.private";
}
}
# Sign outbound mail only
sign_authenticated = true;
sign_local = true;
sign_inbound = false;
use_domain = "header";
allow_hdrfrom_mismatch = true;
allow_username_mismatch = false;
header_canon = "relaxed";
body_canon = "relaxed";
# Default settings
use_esld = false;
check_pubkey = true;
try_fallback = true;
sign_networks = ["127.0.0.1, YOUR PUBLIC IP ADDRESS HERE"];
Don't forget to add your server's public ip as indicated above or you mails will not get signed!
Save and quit and do:
sudo systemctl restart opendkim
sudo systemctl restart postfix
sudo systemctl restart rspamd
Test the changes by using the site mail-tester.org to send an email, following their instructions, or by sending an email to check-auth@verifier.port25.com and waiting for their reply.
