Installing and Configuring DKIM (DomainKeys Identified Mail) with Postfix

Posted on: February 25, 2012 July 21, 2026
Categories: Uncategorized

Introduction

DomainKeys Identified Mail (DKIM) is an email authentication mechanism that helps prevent email spoofing and improves email deliverability. It allows a mail server to digitally sign outgoing emails using a private cryptographic key. The corresponding public key is published in the domain’s DNS records, enabling receiving mail servers to verify that the message was sent by an authorized server and has not been modified during transit.

DKIM builds upon the older DomainKeys standard by providing a more flexible and robust authentication framework. Today, DKIM is widely used alongside SPF (Sender Policy Framework) and DMARC (Domain-based Message Authentication, Reporting, and Conformance) to strengthen email security and reduce the likelihood of legitimate emails being marked as spam.

This guide explains how to install and configure DKIMProxy with Postfix to sign outgoing emails.

Prerequisites

Before beginning the installation, ensure the following requirements are met:

System Requirements

Linux server with Postfix installed and configured
Root or sudo access
OpenSSL installed
Perl installed
Internet connectivity for downloading packages

Perl Modules

Install the required Perl modules using CPAN.

cpan Crypt::OpenSSL::RSA
cpan Digest::SHA
cpan Mail::Address
cpan MIME::Base64
cpan Net::DNS
cpan Net::Server
cpan Error

Install Mail::DKIM

Download and install the Mail::DKIM module manually.

wget http://search.cpan.org/CPAN/authors/id/J/JA/JASLONG/Mail-DKIM-0.39.tar.gz

tar -zxvf Mail-DKIM-0.39.tar.gz

cd Mail-DKIM-0.39

perl Makefile.PL
make
make test
make install

Step 1: Install DKIMProxy

Download and install DKIMProxy.

wget http://downloads.sourceforge.net/project/dkimproxy/dkimproxy/1.4.1/dkimproxy-1.4.1.tar.gz

tar -zxvf dkimproxy-1.4.1.tar.gz

cd dkimproxy-1.4.1

./configure --prefix=/usr/local/dkimproxy

make

make install

Copy the sample startup script.

cp sample-dkim-init-script.sh /etc/init.d/dkimproxy

Create a dedicated user for running DKIMProxy.

useradd -d /usr/local/dkimproxy dkim

Step 2: Generate DKIM Keys

Navigate to the installation directory.

cd /usr/local/dkimproxy/

Generate the private key.

openssl genrsa -out private.key 1024

Generate the public key.

openssl rsa -in private.key -pubout -out public.key

Display the public key.

cat public.key

Step 3: Publish the Public Key in DNS

Create a TXT record in your DNS zone.

Example:

selector1._domainkey.example.com IN TXT "k=rsa; t=s; p=PUBLIC_KEY"

Replace:

selector1 with your selector
example.com with your domain
PUBLIC_KEY with the contents of public.key (without line breaks)

Allow DNS propagation (typically 24–48 hours).

Verify the DNS record.

host -t txt selector1._domainkey.example.com

Step 4: Configure DKIMProxy

Create the configuration file.

/usr/local/dkimproxy/etc/dkimproxy_out.conf

Example configuration:

listen      127.0.0.1:10037

relay       127.0.0.1:10038

domain      example.com

signature dkim(c=relaxed)
signature domainkeys(c=nofws)

keyfile     /usr/local/dkimproxy/private.key

selector    selector1

Configuration Parameters

Parameter	Description
listen	Port where DKIMProxy listens
relay	Port to forward signed mail
domain	Domain(s) to sign
keyfile	Path to the private key
selector	DNS selector name
signature	Signature format

Step 5: Start DKIMProxy

Start the service.

/etc/init.d/dkimproxy start

Enable it during boot.

chkconfig dkimproxy on

Step 6: Configure Postfix

Edit the Postfix master configuration file.

/etc/postfix/master.cf

Modify the submission service.

submission inet n - n - - smtpd
  -o smtpd_etrn_restrictions=reject
  -o smtpd_sasl_auth_enable=yes
  -o content_filter=dksign:[127.0.0.1]:10037
  -o receive_override_options=no_address_mappings
  -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject

Add the DKIM signing service.

dksign unix - - n - 4 smtp
  -o smtp_send_xforward_command=yes
  -o smtp_discard_ehlo_keywords=8bitmime,starttls

Add the SMTP listener for signed mail.

127.0.0.1:10038 inet n - n - 10 smtpd
  -o content_filter=
  -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
  -o smtpd_helo_restrictions=
  -o smtpd_client_restrictions=
  -o smtpd_sender_restrictions=
  -o smtpd_recipient_restrictions=permit_mynetworks,reject
  -o mynetworks=127.0.0.0/8
  -o smtpd_authorized_xforward_hosts=127.0.0.0/8

Configure the pickup service.

pickup fifo n - n 60 1 pickup
  -o content_filter=dksign:[127.0.0.1]:10037

Reload Postfix.

postfix reload

Step 7: Verify DKIMProxy

Check that DKIMProxy is listening.

netstat -plan | grep perl | grep 10037

Expected output:

tcp 0 0 127.0.0.1:10037 0.0.0.0:* LISTEN

Step 8: Verify DKIM Signatures

Send a test email to Port25’s verification service.

mail -v check-auth@verifier.port25.com

Alternatively, send an email to:

check-auth@verifier.port25.com

The service will return a report showing:

DKIM Result
SPF Result
Reverse DNS
Sender Authentication
Spam Score

You can also use tools such as:

Conclusion

Implementing DKIM with Postfix provides an additional layer of email authentication by digitally signing outgoing messages. This enables recipient mail servers to verify the authenticity and integrity of emails, reducing the risk of spoofing and improving deliverability. Combined with SPF and DMARC, DKIM forms a comprehensive email security framework that enhances trust between sending and receiving mail servers. After completing the installation and configuration, it is recommended to periodically verify DKIM signatures using online testing tools and monitor DNS records to ensure the authentication mechanism continues to function correctly.

Post Views: 208

admin

767