DomainKeys Identified Mail (DKIM)<\/strong> is an email authentication mechanism that helps prevent email spoofing and improves email deliverability. It allows a mail server to digitally sign outgoing emails using a private cryptographic key. The corresponding public key is published in the domain’s DNS records, enabling receiving mail servers to verify that the message was sent by an authorized server and has not been modified during transit.<\/p>\n\n\n\n DKIM builds upon the older DomainKeys<\/strong> standard by providing a more flexible and robust authentication framework. Today, DKIM is widely used alongside SPF (Sender Policy Framework)<\/strong> and DMARC (Domain-based Message Authentication, Reporting, and Conformance)<\/strong> to strengthen email security and reduce the likelihood of legitimate emails being marked as spam.<\/p>\n\n\n\n This guide explains how to install and configure DKIMProxy<\/strong> with Postfix<\/strong> to sign outgoing emails.<\/p>\n\n\n\n Before beginning the installation, ensure the following requirements are met:<\/p>\n\n\n\n Install the required Perl modules using CPAN.<\/p>\n\n\n\n Download and install the Mail::DKIM module manually.<\/p>\n\n\n\n Download and install DKIMProxy.<\/p>\n\n\n\n Copy the sample startup script.<\/p>\n\n\n\n Create a dedicated user for running DKIMProxy.<\/p>\n\n\n\n Navigate to the installation directory.<\/p>\n\n\n\n Generate the private key.<\/p>\n\n\n\n Generate the public key.<\/p>\n\n\n\n Display the public key.<\/p>\n\n\n\n Create a TXT record in your DNS zone.<\/p>\n\n\n\n Example:<\/p>\n\n\n\n Replace:<\/p>\n\n\n\n Allow DNS propagation (typically 24\u201348 hours).<\/p>\n\n\n\n Verify the DNS record.<\/p>\n\n\n\n Create the configuration file.<\/p>\n\n\n\n Example configuration:<\/p>\n\n\n\n Start the service.<\/p>\n\n\n\n Enable it during boot.<\/p>\n\n\n\n Edit the Postfix master configuration file.<\/p>\n\n\n\n Modify the submission<\/strong> service.<\/p>\n\n\n\n Add the DKIM signing service.<\/p>\n\n\n\n Add the SMTP listener for signed mail.<\/p>\n\n\n\n Configure the pickup service.<\/p>\n\n\n\n Reload Postfix.<\/p>\n\n\n\n Check that DKIMProxy is listening.<\/p>\n\n\n\n Expected output:<\/p>\n\n\n\n Send a test email to Port25’s verification service.<\/p>\n\n\n\n Alternatively, send an email to:<\/p>\n\n\n\n The service will return a report showing:<\/p>\n\n\n\n You can also use tools such as:<\/p>\n\n\n\n Implementing DKIM with Postfix provides an additional layer of email authentication by digitally signing outgoing messages. This enables recipient mail servers to verify the authenticity and integrity of emails, reducing the risk of spoofing and improving deliverability. Combined with SPF and DMARC, DKIM forms a comprehensive email security framework that enhances trust between sending and receiving mail servers. After completing the installation and configuration, it is recommended to periodically verify DKIM signatures using online testing tools and monitor DNS records to ensure the authentication mechanism continues to function correctly.<\/p>\n","protected":false},"excerpt":{"rendered":"
\n\n\n\nPrerequisites<\/h1>\n\n\n\n
System Requirements<\/h3>\n\n\n\n
\n
Perl Modules<\/h3>\n\n\n\n
cpan Crypt::OpenSSL::RSA\ncpan Digest::SHA\ncpan Mail::Address\ncpan MIME::Base64\ncpan Net::DNS\ncpan Net::Server\ncpan Error\n<\/pre>\n\n\n\n
Install Mail::DKIM<\/h3>\n\n\n\n
wget http:\/\/search.cpan.org\/CPAN\/authors\/id\/J\/JA\/JASLONG\/Mail-DKIM-0.39.tar.gz\n\ntar -zxvf Mail-DKIM-0.39.tar.gz\n\ncd Mail-DKIM-0.39\n\nperl Makefile.PL\nmake\nmake test\nmake install\n<\/pre>\n\n\n\n
\n\n\n\nStep 1: Install DKIMProxy<\/h1>\n\n\n\n
wget http:\/\/downloads.sourceforge.net\/project\/dkimproxy\/dkimproxy\/1.4.1\/dkimproxy-1.4.1.tar.gz\n\ntar -zxvf dkimproxy-1.4.1.tar.gz\n\ncd dkimproxy-1.4.1\n\n.\/configure --prefix=\/usr\/local\/dkimproxy\n\nmake\n\nmake install\n<\/pre>\n\n\n\n
cp sample-dkim-init-script.sh \/etc\/init.d\/dkimproxy\n<\/pre>\n\n\n\n
useradd -d \/usr\/local\/dkimproxy dkim\n<\/pre>\n\n\n\n
\n\n\n\nStep 2: Generate DKIM Keys<\/h1>\n\n\n\n
cd \/usr\/local\/dkimproxy\/\n<\/pre>\n\n\n\n
openssl genrsa -out private.key 1024\n<\/pre>\n\n\n\n
openssl rsa -in private.key -pubout -out public.key\n<\/pre>\n\n\n\n
cat public.key\n<\/pre>\n\n\n\n
\n\n\n\nStep 3: Publish the Public Key in DNS<\/h1>\n\n\n\n
selector1._domainkey.example.com IN TXT \"k=rsa; t=s; p=PUBLIC_KEY\"\n<\/pre>\n\n\n\n
\n
public.key<\/code> (without line breaks)<\/li>\n<\/ul>\n\n\n\nhost -t txt selector1._domainkey.example.com\n<\/pre>\n\n\n\n
\n\n\n\nStep 4: Configure DKIMProxy<\/h1>\n\n\n\n
\/usr\/local\/dkimproxy\/etc\/dkimproxy_out.conf\n<\/pre>\n\n\n\n
listen 127.0.0.1:10037\n\nrelay 127.0.0.1:10038\n\ndomain example.com\n\nsignature dkim(c=relaxed)\nsignature domainkeys(c=nofws)\n\nkeyfile \/usr\/local\/dkimproxy\/private.key\n\nselector selector1\n<\/pre>\n\n\n\n
Configuration Parameters<\/h3>\n\n\n\n
Parameter<\/th> Description<\/th><\/tr><\/thead> listen<\/td> Port where DKIMProxy listens<\/td><\/tr> relay<\/td> Port to forward signed mail<\/td><\/tr> domain<\/td> Domain(s) to sign<\/td><\/tr> keyfile<\/td> Path to the private key<\/td><\/tr> selector<\/td> DNS selector name<\/td><\/tr> signature<\/td> Signature format<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\nStep 5: Start DKIMProxy<\/h1>\n\n\n\n
\/etc\/init.d\/dkimproxy start\n<\/pre>\n\n\n\n
chkconfig dkimproxy on\n<\/pre>\n\n\n\n
\n\n\n\nStep 6: Configure Postfix<\/h1>\n\n\n\n
\/etc\/postfix\/master.cf\n<\/pre>\n\n\n\n
submission inet n - n - - smtpd\n -o smtpd_etrn_restrictions=reject\n -o smtpd_sasl_auth_enable=yes\n -o content_filter=dksign:[127.0.0.1]:10037\n -o receive_override_options=no_address_mappings\n -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject\n<\/pre>\n\n\n\n
dksign unix - - n - 4 smtp\n -o smtp_send_xforward_command=yes\n -o smtp_discard_ehlo_keywords=8bitmime,starttls\n<\/pre>\n\n\n\n
127.0.0.1:10038 inet n - n - 10 smtpd\n -o content_filter=\n -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks\n -o smtpd_helo_restrictions=\n -o smtpd_client_restrictions=\n -o smtpd_sender_restrictions=\n -o smtpd_recipient_restrictions=permit_mynetworks,reject\n -o mynetworks=127.0.0.0\/8\n -o smtpd_authorized_xforward_hosts=127.0.0.0\/8\n<\/pre>\n\n\n\n
pickup fifo n - n 60 1 pickup\n -o content_filter=dksign:[127.0.0.1]:10037\n<\/pre>\n\n\n\n
postfix reload\n<\/pre>\n\n\n\n
\n\n\n\nStep 7: Verify DKIMProxy<\/h1>\n\n\n\n
netstat -plan | grep perl | grep 10037\n<\/pre>\n\n\n\n
tcp 0 0 127.0.0.1:10037 0.0.0.0:* LISTEN\n<\/pre>\n\n\n\n
\n\n\n\nStep 8: Verify DKIM Signatures<\/h1>\n\n\n\n
mail -v check-auth@verifier.port25.com\n<\/pre>\n\n\n\n
check-auth@verifier.port25.com\n<\/pre>\n\n\n\n
\n
\n
\n\n\n\nConclusion<\/h1>\n\n\n\n