I was playing these days with Postfix on my server with Hardy on it, so I said why not making it speak DKIM? (My server already speaks SPF!)
Easy to say, almost impossible to make!

The problem with DKIM is that, nowadays you can find several tools that will theoretically allow you to build a mail server which verifies and signs outgoing emails with domain keys, but that is a horror when it comes to work with those tools.

For solving my problem I started with dkfilter trying to compile it. The problem with dkfilter is that it uses several Perl libraries, so after getting those from CPAN, one of it was asking to be compiled, and it’s compilation finished with an error! … I moved on, joined the #postfix on freenode and started to ask pals for help and thoughts. From that point I found dkim-milter. After a bit of digging, I did also found that the package dkim-filter from Ubuntu repositories is actually dkim-milter I was reading (and already trying to compile).

From here starts the real tutorial…
Install dkim-filter (actually this is the tool which will verify and sign the emails for our server)
sudo apt-get install dkim-filter
After installation, dpkg will throw you an error, don’t worry, it is trying to start the daemon dkim-filter which can’t be started until it will be configured.

For that you’ll need some keys and to edit the /etc/dkim-filter.conf
Here’s how to get the keys (the first one will be the private key, and the second will be the public one):

openssl genrsa -out private.key 1024
openssl rsa -in rsa.private -out public.key -pubout -outform PEM

I recommend you moving the keys somewhere where those will be more protected than your home folder (somewhere in /var/dkim-filter/ is ok).
For making DKIM work, you’ll also need to add some DNS records! I’m using domain.tld for examples, but if you have subdomain.domain.tld, DKIM works with sub domains!!!

Create a DNS TXT record for selector._domainkey.domain.tld as follows:
mail._domainkey.domain.tld. IN TXT "k=rsa; t=y; p=PpYHdE2tevfEpvL1Tk2dDYv0pF28/f 5MxU83x/0bsn4R4p7waPaz1IbOGs/6bm5QIDAQAB"
(the string after p= is the base64 encoding of your public key.
If the public.key file which was generated contains:

-----BEGIN PUBLIC KEY-----
PpYHdE2tevfEpvL1Tk2dDYv0pF28/f 5MxU83x/0bsn4R4p7waPaz1IbOGs/6bm5QIDAQAB
-----END PUBLIC KEY-------

the base64 encoding is everything between the first ----- BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- lines, remove any spaces and newlines, the t=y value pair means that the domain is using this key in test mode, also that is activated).

After this you can start editing /etc/dkim-filter.conf. Actually the contents of that file are really explicit and well commented, so I believe you won’t get in troubles. (Remember, if your server is on a sub domain, edit it considering that!)
After you can start up the daemon:
sudo /etc/init.d/dkim-filter start
You can check if it started by looking inside logs (try: less /var/log/mail.log and look for word DKIM).

Now let’s make Postfix use our milter!
Edit your /etc/postfix/main.cf and append the following lined to the end of file:

milter_default_action = accept
milter_protocol = 2
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891


This is the minimum of configuration to make Postfix use the our milter, and in my case it was enough for making it work!

Save the file and then restart Postfix:
sudo /etc/init.d/postfix restart

Give some time for DNS services be activated, and then let’s test our new milter!
I found several DKIM checkers, for ex.: SkyList, ESPCoalition for emails and Sendmail, Yahoo tools for DNS.
(Don’t worry if those will say that the algorithm rsa-sha256 is not supported, the tools are a bit outdated…)

I’m also open for further discussions on this topic, or If you need to ask something, I’ll be happy to reply to your comments.
Hope that this article helped you somehow….