Configuring Postfix + DomainKeys (+ DKIM) on Ubuntu Hardy

Postfix + dk-filter + dkim on UBuntu
Ok, If you remember, this morning I wrote an article about how to make you mail server which uses Postfix, to be able to sign the outgoing messages using DKIM. I moved on, and start digging about DomainKeys, and how that feature can be used with Postfix. Of course, our server runs on Ubuntu Hardy.

First you need the milter wich will sign or verify your messages with Postfix. I searched the web and found that Ubuntu repositories already provide such a package wich is called dk-filter (actually, it is build from dk-milter).
Install dk-filter:
sudo apt-get install dk-filter

After installation, you will also need a key for signing/verifying emails and setting up DNS TXT records (I’ll just copy paste this step from the previous post…).
Here’s how to get the keys (the first one will be the private key, and the second will be the public one):
openssl genrsa -out private.key 1024 openssl rsa -in rsa.private -out public.key -pubout -outform PEM
I recommend you moving the keys somewhere where those will be more protected than your home folder (somewhere in /var/dk-filter/ is ok).
For making DK work, you’ll also need to add some DNS records! I’m using domain.tld for examples, but if you have subdomain.domain.tld, DKIM works with sub domains!!!

Create a DNS TXT record for selector._domainkey.domain.tld as follows:
_domainkey.domain.tld. IN TXT "t=y; o=~;"
(the t=y means that the domain is in test mode, actually that it is activated, and the o=~; means that some mail is being signed from this domain).
mail._domainkey.domain.tld. IN TXT "k=rsa; t=y; p=PpYHdE2tevfEpvL1Tk2dDYv0pF28/f 5MxU83x/0bsn4R4p7waPaz1IbOGs/6bm5QIDAQAB"
(the string after p= is the base64 encoding of your public key.
If the public.key file which was generated contains:
-----BEGIN PUBLIC KEY----- PpYHdE2tevfEpvL1Tk2dDYv0pF28/f 5MxU83x/0bsn4R4p7waPaz1IbOGs/6bm5QIDAQAB -----END PUBLIC KEY-------
the base64 encoding is everything between the first ----- BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- lines, remove any spaces and newlines, the t=y value pair means that the domain is using this key in test mode, also that is activated).

Net you need to edit your configuration for dk-filter. The file can be found /etc/default/dk-filter
(the contents of that file are very explicit and commented so I believe you won’t get stuck, just mention your domain and the path to your key file).

Now, before starting the daemon, you’ll need to specify a port number. Do this by editing the same /etc/default/dk-filter and un-commenting one of the lines that can be found at the end of file. It will look like this after you are done:
SOCKET="inet:8892@localhost" # listen on loopback on port 8892

The dk-filter daemon now can be started using /etc/init.d/dk-filter start (if the daemon is already started, use /etc/init.d/dk-filter restart).

Back to Postfix. As your probably found already, dk-filter is actually a milter, so you can use smtpd_milters to pass your new milter to Postfix… Add to the end of /etc/postfix/main.cf for example:
milter_default_action = accept milter_protocol = 2 smtpd_milters = inet:localhost:8892 non_smtpd_milters = inet:localhost:8892

If you are using already some milter, like I do (remember DKIM), you can add the new one like this:
milter_default_action = accept milter_protocol = 2 smtpd_milters = inet:localhost:8891,inet:localhost:8892 non_smtpd_milters = inet:localhost:8891,inet:localhost:8892

This is the minimum of configuration to make Postfix use the our milter, and in my case it was enough for making it work!

Now you can restart Postfix:
sudo /etc/init.d/postfix restart

Give some time for DNS services be activated, and then let’s test our new milter!
I found several DKIM/DK checkers, for ex.: SkyList, ESPCoalition for emails and Sendmail, Yahoo tools for DNS.
(Don’t worry if those will say that the algorithm rsa-sha256 is not supported, the tools are a bit outdated…)

I’m also open for further discussions on this topic, or If you need to ask something, I’ll be happy to reply to your comments.
Hope that this article helped you somehow….

Special note: I owe some credits to dk-milter discussion list on sourceforge and especially to Murray S. Kucherawy. I would also want to thank Noel Jones for pointing me the right direction.

17 thoughts on “Configuring Postfix + DomainKeys (+ DKIM) on Ubuntu Hardy”

Great guide, it saved me a lot of time!

A couple of extra points I ran into:

dkim:

Needed to add “Canonicalization relaxed” in my dkim-filter.conf I was able to send fine using the command line, bbut when I sent from a rails app, the extra headers were causing me problems getting my email to pass verification.

dk:

As above, I needed canonicalization more relaxed, the option for dk being “-c nofws” in df-filter,conf. I also need to add in the “-H” parameter before yahoo would pass my email.

17 thoughts on “Configuring Postfix + DomainKeys (+ DKIM) on Ubuntu Hardy”

Lasă un răspuns Anulează răspuns