Among others, Google Gmail and Yahoo mail check your email for a DKIM signature.

Install and Configure OpenDKIM

1. Install OpenDKIM

[code]apt-get install opendkim[/code]

Comment: This will install the latest available stable Debian packaged version of OpenDKIM which is currently 2.0.1. This version is already a couple of years old (2010).
If you know how/want to compile sources yourself, then the latest version is 2.4.3 (and 2.5.0 is right around the corner)

2. Edit the OpenDKIM config file

[code]nano /etc/opendkim.conf[/code]

Add these rows:

[code]
KeyTable /etc/opendkim/KeyTable
SigningTable /etc/opendkim/SigningTable
ExternalIgnoreList /etc/opendkim/TrustedHosts
InternalHosts /etc/opendkim/TrustedHosts
[/code]

Note: If you run multiple instances of Postfix you need to add this to the opendkim.conf for each instance (or the ones you want to use opendkim)

3.  Edit /etc/opendkim/TrustedHosts

[code]nano /etc/opendkim/TrustedHosts[/code]

Add domains, hostnames and/or ip’s that should be handled by OpenDKIM. Don’t forget localhost.

[code]
127.0.0.1
localhost
x.253.204.64
x.253.204.32/27
[/code]

4. Edit /etc/default/opendkim

[code]nano /etc/default/opendkim[/code]

Uncomment this row:

[code]SOCKET="inet:12345@localhost" # listen on loopback on port 12345[/code]

Generate keys

Repeat these steps to generate keys for each domain you will send email from. Replace mydomain.com with your domain name in examples below.

1. Generate key

[code]
mkdir -p /etc/opendkim/keys/mydomain.com
cd /etc/opendkim/keys/mydomain.com
opendkim-genkey -r -d mydomain.com
chown opendkim:opendkim default.private
[/code]

2. Add domain to KeyTable /etc/opendkim/KeyTable

[code]nano /etc/opendkim/KeyTable[/code]

Add line:

[code]default._domainkey.mydomain.com mydomain.com:default:/etc/opendkim/keys/mydomain.com/default.private[/code]

3. Add domain to SigningTable /etc/opendkim/SigningTable

[code]nano /etc/opendkim/SigningTable[/code]

Add line:

[code]mydomain.com default._domainkey.mydomain.com[/code]

Note that in OpenDKIM 2.0.1 domain names are case sensitive (supposed to be fixed from 2.3.1 but I have not tested).
This means that in the above example an email from info@mydomain.com will be signed, but an email from info@MyDomain.com will not be signed. The workaround is to add one extra entry for MyDomain.com to SigningTable.

4. Add to DKIM public key to DNS

Add an entry for the public key to the DNS server you are using for your domain. You find the public key here:

[code]cat /etc/opendkim/keys/mydomain.com/default.txt[/code]

Start OpenDKIM

[code]/etc/init.d/opendkim start[/code]

In the future, if you make any changes to configuration remember to restart: /etc/init.d/opendkim restart

Configure and Restart Postifx

1. Configure Postfix

[code]nano /etc/postfix/main.cf[/code]

Add or edit these lines:

[code]
milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:localhost:12345
non_smtpd_milters = inet:localhost:12345
[/code]

2. Restart Postfix

[code]/etc/init.d/postfix reload[/code]

Or in my case as i run postfix multi instance:

[code]/etc/init.d/postfix-multi restart[/code]

Other

Log files are in the /var/log directory

[code]
cat /var/log/mail.log
cat /var/log/mail.warn
cat /var/log/mail.err
[/code]

Log more info

[code]nano /etc/opendkim.conf[/code]

Add this line:

[code]LogWhy yes[/code]

Credits

Guides that have helped me along the way: Debian Tutorials and Syslog

I have kept getting errors like this in /var/log/mail.log

[code]Feb 28 11:21:43 06-135-D2 opendkim[27826]: 5EADD532313: dkim_eom(): resource unavailable: d2i_PrivateKey_bio() failed

Feb 28 11:24:00 06-135-D2 opendkim[27955]: D2560532313 error loading key `default._domainkey.mydomain.com'[/code]

Unfortunately OpenDKIM does not give more info than this and Googling did not provide many hints mor than possibly being a directory access problem. I checked directory and file access and realized that the key file was only readable by root.

[code]-rw——- 1 root root 891 Feb 28 00:14 default.private[/code]

Testing Permissions
(you can skip straight to Solution below)

[Edit: Renamed this part from “Solution” to “Testing Permissions” and added a better Solution below. Thanks to Andreas Schultze on the OpenDKIM mailing list for getting me on the right track to finding the correct solution]

As I used opendkim-genkey to generate my key I would have thought permissions would be set ok from the start but I anyway tried doing chmod 644 on the key file

[code]chmod 644 default.private[/code]
[code]-rw-r–r– 1 root root 891 Feb 28 00:14 default.private[/code]

And finally – success!
In /var/log/mail.log:

[code]Feb 28 11:30:28 06-135-D2 opendkim[27955]: 5E811532313 "DKIM-Signature" header added[/code]

To me it seems a little unsecure to do chmod 644 on the file as this means anyone with access to the system can read the private key. In my case I consider my system secure as it is only used for SMTP/Postfix so I am happy that is working.

As I am all new to Debian, OpenDKIM and Postfix (The last time I touched Unix was when I worked with IBM’s AIX on their RS/6000 systems in the early 90s…) so I would be happy to hear any thoughts on this.

Solution

To set permissions to allow OpenDKIM but no unauthorized users to access the private key, change owner of the private key file to user and group opendkim with the following command:

[code]chown opendkim:opendkim default.private[/code]

(To check what user opendkim is running as, check the running processes once you have started opendkim: ps -f -A
This command shows what groups the user opendkim belongs to: group opendkim)

Maybe this is fixed to set file permissions correctly in a later version of opendkim-genkey, I am running the old 2.0.1 apt-get package that is currently available for Debian.