DKIM – instalacja

OpenDKIM

Konfiguracja

/etc/opendkim.conf:

Mode                    sv

ExternalIgnoreList      refile:/etc/opendkim/TrustedHosts
InternalHosts           refile:/etc/opendkim/TrustedHosts
KeyTable                refile:/etc/opendkim/KeyTable
SigningTable            refile:/etc/opendkim/SigningTable

UserID                  opendkim:opendkim
Socket                  inet:12301@localhost

Uwaga

Socket możesz ustawić też w /etc/default/opendkim:

# cat /etc/default/opendkim 
# Command-line options specified here will override the contents of
# /etc/opendkim.conf. See opendkim(8) for a complete list of options.
#DAEMON_OPTS=""
#
# Uncomment to specify an alternate socket
# Note that setting this will override any Socket value in opendkim.conf
#SOCKET="local:/var/run/opendkim/opendkim.sock" # default
#SOCKET="inet:54321" # listen on all interfaces on port 54321
#SOCKET="inet:12345@localhost" # listen on loopback on port 12345
#SOCKET="inet:12345@192.0.2.1" # listen on 192.0.2.1 on port 12345

/etc/opendkim/TrustedHosts:

127.0.0.1
localhost
192.168.0.0/24

bogus.corp
kb.bogus.corp

/etc/opendkim/KeyTable:

dk1._domainkey.bogus.corp bogus.corp:mail:/etc/opendkim/keys/bogus.corp/dk1.private
dk1._domainkey.kb.bogus.corp kb.bogus.corp:mail:/etc/opendkim/keys/kb.bogus.corp/dk1.private

/etc/opendkim/SigningTable:

*@bogus.corp dk1._domainkey.bogus.corp
*@kb.bogus.corp dk1._domainkey.kb.bogus.corp

Klucze

mkdir /etc/opendkim/keys/bogus.corp
mkdir /etc/opendkim/keys/kb.bogus.corp

sudo --user opendkim opendkim-genkey -d bogus.corp \
-D /etc/opendkim/keys/bogus.corp -s dk1 -v
sudo --user opendkim opendkim-genkey -d kb.bogus.corp \
-D /etc/opendkim/keys/kb.bogus.corp -s dk1 -v

Przy restrykcyjnej konf. powłoki (np. umask 027 w .bashrc):

chmod -R u=rwX,g=rX,o= /etc/opendkim && chown -R root:opendkim /etc/opendkim

DNS

Dodaj klucz publiczny jako rekord TXT:

cat /etc/opendkim/keys/bogus.corp/dk1.txt 
dk1._domainkey  IN      TXT     ( "v=DKIM1; k=rsa; "
          "p=MIqGSIb3DGfMA0gCSQEBAQuaA4GNADCBIqkbGQdvTb1FHgMtsjRNYyn3JcgwQWNAtukPxcFpP/93Gq47GKt2lD2+MeAe3OqCtJoNaxakdxYUIpn/FtZDN3dz7CclHgaiVSlhZCjy53FNa98u8FoNOap2xBd8e+1N36uscuxFOVjqLWUaE5IeRH9aDFjqYdxsEyokiH46IPJaMsFGtwIDAQAB")  ; ----- DKIM key dk1 for bogus.corp

Postfix

/etc/postfix/main.cf:

[...]
milter_protocol = 2
smtpd_milters = inet:127.0.0.1:12301
non_smtpd_milters = $smtpd_milters 
milter_default_action = accept
[...]

service opendkim restart
service postfix restart

Sprawdzanie

dig -t TXT +short dk1._domainkey.bogus.corp
"v=DKIM1; k=rsa; "
"p=MIqGSIb3DGfMA0gCSQEBAQuaA4GNADCBIqkbGQdvTb1FHgMtsjRNYyn3JcgwQWNAtukPxcFpP/93G
q47GKt2lD2+MeAe3OqCtJoNaxakdxYUIpn/FtZDN3dz7CclHgaiVSlhZCjy53FNa98u8FoNOap2xBd8e
+1N36uscuxFOVjqLWUaE5IeRH9aDFjqYdxsEyokiH46IPJaMsFGtwIDAQAB"

Refs