One thing you can do is use DKIM, which stands for DomainKeys Identified Mail. DKIM is a result of a merging between Yahoo's DomainKeys and Cisco's Identified Internet Mail. There's a great Wikipedia article on DKIM which I strongly recommend you read.
DKIM is a method for email authentication -- in a nutshell, mail senders use DKIM to digitally sign messages they send with a private key. They also publish the corresponding public key as a DNS record. On the receiving side, mail servers use the public key to verify the digital signature. So by using DKIM, you as a mail sender prove to your mail recipients that you are who you say you are.
Note that DKIM doesn't prevent spam. Spammers can also use DKIM, and sign their messages. However, DKIM achieves an important goal, which is to prevent spammers from spoofing the source of their emails and impersonate users in other mail domains by forging the 'From:' header in their spam emails. If spammers want to use DKIM, they are thus forced to use their real domain name in the 'From' header, and this makes it easier for the receiving mail servers to reject that email. See also 'Three myths about DKIM' by John R. Levine.
As an email sender, if you use DKIM, then your chances of your mail servers being whitelisted and of your mail domain being considered 'reputable' are increased.
Enough theory, let's see how you can set up DKIM with postfix. I'm going to use OpenDKIM and postfix on an Ubuntu 9.04 server.
1) Install prerequisites
# apt-get install libssl-dev libmilter-dev
2) Download and install OpenDKIM
# wget http://downloads.sourceforge.net/project/opendkim/opendkim-2.0.1.tar.gz
# tar xvfz opendkim-2.0.1.tar.gz
# cd opendkim-2.0.1
# make install
You will also need to add /usr/local/lib to the paths inspected by ldconfig, otherwise opendkim will not find its required shared libraries when starting up. I created a file called /etc/ld.so.conf.d/opendkim.conf containing just one line:
Then I ran:
3) Add a 'dkim' user and group
# useradd dkim
4) Use the opendkim-genkey.sh script to generate a private key (in PEM format) and a corresponding public key inside a TXT record that you will publish in your DNS zone. The opendkim-genkey.sh script takes as arguments your DNS domain name (-d) and a so-called selector, which identifies this particular private key/DNS record combination. You can choose any selector name you want. In my example I chose MAILOUT.
# cd ~/opendkim-2.0.1/opendkim
# ./opendkim-genkey.sh -d mydomain.com -s MAILOUT
# mkdir -p /var/db/dkim
# cp MAILOUT.private /var/db/dkim/MAILOUT.key.pem
The opendkim-genkey.sh script generates a private key called MAILOUT.private, which I'm copying to /var/db/dkim/MAILOUT.key.pem. It also generates a file called MAILOUT.txt which contains the TXT record that you need to add to your DNS zone:
# cat MAILOUT.txt
MAILOUT._domainkey IN TXT "v=DKIM1; g=*; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADGTeQKBgQDATldYm37cGn6W1TS1Ukqy2ata8w2mw+JagOC+GNEi02gvDyDtfTT0ivczPl45V1SqyQhdwF3dPnhkUXgxjjzBvU6+5uTFU4kzrKz0Ew7vywsCMcfKUjYhtVTAbKAy+5Vf3CNmOlFlJnnh/fdQHVsHqqNjQII/13bVtcfYPGOXJwIDAQAB" ; ----- DKIM MAILOUT for mydomain.com
5) Configure DNS
Add the generated TXT record to the DNS zone for mydomain.com.
6) Configure opendkim
There is a sample file called opendkim.conf.sample located in the root directory of the opendkim source distribution. I copied it as /etc/opendkim.conf, then I set the following variables (this article by Eland Systems was very helpful):
Note the InternalHosts setting. It points to a file listing IP addresses that belong to servers which use your mail server as a mail relay. They could be for example your application servers that send email via your mail server. You need to list their IP addresses in that file, otherwise mail sent by them will NOT be signed by your mail server running opendkim.
7) Start up opendkim
# /usr/local/sbin/opendkim -x /etc/opendkim.conf
At this point, opendkim is running and listening on the port you specified in the config file -- in my case 9999.
8) Configure postfix
You need to configure postfix to use opendkim as an SMTP milter.
Note that the postfix syntax in the opendkim documentation is wrong. I googled around and found this blog post which solved the issue.
Edit /etc/postfix/main.cf and add the following line:
smtpd_milters = inet:localhost:9999
(the port needs to be the same as the one opendkim is listening on)
Reload the postfix configuration:
# service postfix reload
At first, I didn't know about the InternalHosts trick, so I was baffled when email sent from my application servers wasn't being signed by opendkim. To troubleshoot, make sure you set
in opendkim.conf and then inspect /var/log/mail.log and google for any warnings you find (remember to always RTFL!!!).
When you're done troubleshooting, set LogWhy back to 'no' so that you don't log excessively.
10) Verifying your DKIM setup
At this point, try to send email to some of your email accounts such as gmail, yahoo, etc. When you get the email there, show all headers and make sure you see the DKIM-Signature and X-DKIM headers. Here's an example from an email I received in my GMail account (you need to click the 'Reply' drop-down and choose 'Show original' to see all the headers):
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mydomain.com;
X-DKIM: OpenDKIM Filter v2.0.1 mymailserver 4B4B864925
That's about it. There are quite a few moving parts here, so I hope somebody will find this useful.
Good writeup. OpenDKIM will be packaged in Ubuntu's repo for 10.4 (Lucid), which will eliminate the install from source portion.
After a week of broken DKIM setups this appears to work perfectly, thank you. One note that should be taken is that the packaged version for Ubuntu does not seem to include the opendkim-genkey script, so I installed from source anyway.
Great writeup, thank you.
Is there a way to use a socket file instead of inet?
Sure, use a socket specification of "local:/path" or "unix:/path".
Thanks for this writeup. I tested the generated record with http://www.sendmail.org/dkim/checker,which says that 'r' is an unknown tag... Any idea why that is?
Thank you so much!!! Great work.
This works on Ubuntu 11.10 Server, as of 5/2012. Nice job. If it doesn't work for you, check your configuration files.. I missed something at first. Also, your DNS provider must support underscore characters in your TXT record names.
Post a Comment