After a long wait of OpenSMTPD 6.6 and its accompanying rspamd filter, I finally sent my mails DKIM-signed. Along the way I also discovered rspamd does a bit too much for my need and learned that it’s way simpler to use dkimproxy instead.
Outline of the steps required as follow:
- Install OpenSMTPD
- Install dkimproxy
- Create signing keys
- Decide “selector” name
- Add relevant DKIM entry to all relevant domains
- Setup dkimproxy to sign stuff
- Setup OpenSMTPD to relay to dkimproxy before finally sending the message
Signing keys are created by:
openssl genrsa -out /etc/mail/dkim/selector1.key 1024
Followed by creating the public key for DNS entry:
openssl rsa -in /etc/mail/dkim/selecto1.key -pubout -out /etc/mail/dkim/selector1.pub
Don’t forget to fix private key permission to 400 owned by whatever user running dkimproxy.
The dkimproxy setting is pretty simple:
listen 127.0.0.1:10027 relay 127.0.0.1:10028 domain domain1.com,domain2.net signature dkim(c=relaxed) signature domainkeys(c=nofws) keyfile /etc/mail/dkim/selector1.key selector selector1
It’s pretty straightforward.
And equally straightforward the settings for OpenSMTPD:
table aliases file:/etc/mail/aliases listen on lo0 listen on lo0 port 10028 tag DKIM action "local" mbox alias <aliases> action "relay_dkim" relay host smtp://127.0.0.1:10027 action "outbound" relay match tag DKIM for any action "outbound" match for local action "local" match for any action "relay_dkim"
First line sets the aliases.
Followed by a listener on localhost because this is just an example for sending-only server.
The listener on port 10028 is to accept the signed mail by DKIM to be finally sent.
local action sending mails to mbox for local user.
relay_dkim action will send mails to dkimproxy which will sign the email…
And relayed to 10028, accepted by smtpd, tagged DKIM and thus will be finally sent to where it should be. I learned the hard way it needs to come first because mails will be acted on first match.
Local for local. Don’t bother doing anything.
And finally the rest will be relayed to dkimproxy. As mentioned above, this must come after the outbound action for DKIM tagged mails.
If you want to run proper mail server with rspamd and stuff, read this instead. That article was also the reason I started looking into all this DKIM stuff.