While a lot of this has been written already, I would like to present this as a little How-To for DKIM in a multidomain environment:
There are a few bits that need to be looked out for:
for one ownership:
Make sure that all files and folders under /etc/opendkim/ have the ownership:
opendkim:opendkim
if you have (like myself) many (email) domains being used, here is a way to reasonably quickly create the keys:
First of all, create a textfile with all the domains (mine is /etc/opendkim/domains.txt):
once you have all the domains in the file, then run the following:
Code: Select all
# while IFS= read -r name; do mkdir -- "/etc/opendkim/keys/$name"; done </etc/opendkim/domains.txt
this will create a subdirectory for each domain
next create the keys:
Code: Select all
# while IFS= read -r name; do opendkim-genkey -D /etc/opendkim/keys/$name -s $name ; done </etc/opendkim/domains.txt
this will create all the keys in their respective folder:
to list the keys that have been created you can run the following:
Code: Select all
# while IFS= read -r name; do cat /etc/opendkim/keys/$name/$name.txt ; done </etc/opendkim/domains.txt
Now that you have all the keys created, you need to do the configuration:
specifically for the creation of a large number of domains, here are a few basic scripts to make life a little easier:
This is the content for the /etc/opendkim.conf file
Code: Select all
SendReports yes
ReportAddress "domain1.net Postmaster <postmaster@domain1.net>"
ReportAddress "domain2.net Postmaster <postmaster@domain1.net>"
ReportAddress "domain3.net Postmaster <postmaster@domain1.net>"
SoftwareHeader yes
Canonicalization relaxed/simple
Here is a little script to make it easier to fill the file and put it in the right format:
Code: Select all
#!/usr/bin/bash
filename="$1"
while read line; do
name="$line"
echo "ReportAddress \"$name Postmaster <postmaster@yourmaindomain.com>\""
done < "$filename"
usage:
Code: Select all
# DkimConf-create.sh /path/to/domainlist >> /etc/opendkim.conf
Then for the KeyTable
/etc/opendkim/KeyTable
Code: Select all
domain1._domainkey.domain1.net domain1.net:domain1:/etc/opendkim/keys/domain1.net/domain1.private
domain2._domainkey.domain2.net domain2.net:domain2:/etc/opendkim/keys/domain2.net/domain2.private
domain3._domainkey.domain3.net domain3.net:domain3:/etc/opendkim/keys/domain3.net/domain3.private
here is the "filling" script for large volumes of domains:
Code: Select all
#!/usr/bin/bash
filename="$1"
while read -r line; do
name="$line"
echo "$name._domainkey.$name $name:$name:/etc/opendkim/keys/$name/$name.private"
done < "$filename"
the usage is:
Code: Select all
# KeyTable-create.sh /path/to/domainlist >> /etc/opendkim/KeyTable
/etc/opendkim/SigningTable
in the following box, this is how it is described in several places, which I found not to be working and giving lots of errors in the logs:
*@domain1.net domain1._domainkey.domain1.net
*@domain2.net domain2._domainkey.domain2.net
*@domain3.net domain3._domainkey.domain3.net
After several trials and errors, the correct (and working) way in eFa should be ("*@" needs to be removed):
Code: Select all
domain1.net domain1._domainkey.domain1.net
domain2.net domain2._domainkey.domain2.net
domain3.net domain3._domainkey.domain3.net
Here is the script to fill the SigningTable file:
Code: Select all
#!/usr/bin/bash
filename="$1"
while read -r line; do
name="$line"
echo "$name $name._domainkey.$name"
done < "$filename"
to be used as follows:
Code: Select all
# SigningTable-create.sh /path/to/domainlist >> /etc/opendkim/SigningTable
/etc/opendkim/TrustedHosts
Code: Select all
mx01.mydomain.net # 1st mail exchanger (MX-Record)
mx02.mydomain.net # 2nd mail exchanger (MX-Record)
192.168.4.5/32 (Mailhost/Exchange Server)
Finally:
you need to have the DNS for all the domains:
As most registrars use webinterfaces here are a few tips:
Code: Select all
Record type: TXT
Hostname: selector._domainkey
Value: "v=DKIM1;k=rsa;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDEl2nednX5/1zjk5R0Hotnb1PLFbfAAGAg0Jv5QSun+fXqvmk4vE/c36ocGA0qjpqZGafpp89Hd0yHjWh1URsv8BwiUv4vDBP0e2MyduOTVshJaKs9HltZjPg21QfHe88L1ObjHZx0WYxqaTO/TT00W0zC1V6Nzkg/nllFZjgySwIDAQAB"
For ease of creating the records, for each domain, I also used the domainname.tld as the selector.
so when you check your DKIM record, you need to enter your domain.tld as selector.
you can check your DKIM record for instance at:
https://mxtoolbox.com/SuperTool.aspx?action=dkim
And finally:
Once you have successfully created the DKIM record, you should also create a DMARC record as this goes hand in hand.
The DMARC record too is a TXT record:
Code: Select all
Record type: TXT
Hostname: _dmarc
Value: v=DMARC1;p=none;sp=quarantine;pct=100;rua=mailto:dmarcreports@yourmaindomain.tld
) and it is advisable to look further into it. This is just supposed to help you get going
I tried to make this as comprehensive as possible, so that als those with less experience get to master the task in a reasonable time.
Please also ensure that you enable DKIM and DMARC in eFa-configure.
Any suggestions for improvements, error corrections, etc. are always welcome.
)