dkim postfix howto


Here some nice howto to setup opendkim with postfix

Install and configure opendkim:

aptitude install opendkim
mkdir -p /etc/opendkim/keys/yourdomain.tld
cd /etc/opendkim/keys/yourdomain.tld
opendkim-genkey -r -d yourdomin.tld
vim /etc/opendkim.conf
AutoRestart             Yes
AutoRestartRate         10/1h
Syslog                  yes
LogWhy                  yes
SyslogSuccess           yes
UMask                   002
Socket                  inet:8891@localhost
KeyTable                refile:/etc/opendkim/keytable
SigningTable            refile:/etc/opendkim/signingtable
vim /etc/opendkim/keytable
default._domainkey.yourdomain.tld yourdomain.tld:default:/etc/opendkim/keys/yourdomain.tld/default.private
vim /etc/opendkim/signingtable
*@yourdomain.tld default._domainkey.yourdomain.tld
vim /etc/postfix/
smtp      inet  n       -       -       -       -       smtpd
        -o smtpd_milters=inet:
smtps     inet  n       -       -       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_milters=inet:
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
/etc/init.d/postfix restart
/etc/init.d/opendkim restart
cat /etc/opendkim/keys/yourdomain.tld/default.txt
add this record to your dns zone of yourdomain.tld

Hint: In ubuntu 12.04 opendkim-genkey has a bug which generates an invalid dkim public key in the default.txt. Here the example:

default._domainkey IN TXT "v=DKIM1;=rsa; p=MIGfMA0GC .... Q7GWwsbQIDAQAB" WRONG
default._domainkey IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GC .... Q7GWwsbQIDAQAB" RIGHT

You can also install a ubuntu backport which does not have the problem

To verify your dkim install you can use any gmail account.
Here Gmails help for this

“mailed-by yourdomain.tld” -> Means your SPF Record is valid
“signed-by yourdomain.tld” -> Means your DKIM Setup is valid

Have fun!