Postfix: DKIM - Revision history

Onnowpurbo: /* Web-based Record Check */

2019-10-04T02:44:16Z

Web-based Record Check

Onnowpurbo: /* DNS Record Setup */

2019-10-04T02:41:00Z

DNS Record Setup

Onnowpurbo at 02:27, 4 October 2019

2019-10-04T02:27:29Z

Onnowpurbo at 02:05, 4 October 2019

2019-10-04T02:05:50Z

Onnowpurbo: /* Pranala Menarik */

2019-10-03T23:08:55Z

Pranala Menarik

Onnowpurbo: Created page with "Sumber: https://easyengine.io/tutorials/mail/dkim-postfix-ubuntu/ DKIM with Postfix If mails from your web-server/webapp is having delivery issues, DKIM (DomainKeys Identif..."

2019-10-03T23:08:14Z

Created page with "Sumber: https://easyengine.io/tutorials/mail/dkim-postfix-ubuntu/ DKIM with Postfix If mails from your web-server/webapp is having delivery issues, DKIM (DomainKeys Identif..."

New page

Sumber: https://easyengine.io/tutorials/mail/dkim-postfix-ubuntu/

DKIM with Postfix

If mails from your web-server/webapp is having delivery issues, DKIM (DomainKeys Identified Mail) can help you big time.

Its highly recommended to use DKIM for outgoing emails even if your server is not running any kind of mail-hosting.

Install DKIM

apt-get install opendkim opendkim-tools

Edit Config files
DKIM config

Open dkim config file vim /etc/opendkim.conf

Add following lines towards end. Make sure you replace example.com with your domain/subdomain.

Domain example.com
KeyFile /etc/postfix/dkim.key
Selector mail
SOCKET inet:8891@localhost

Next open dkim defaults file vim /etc/default/opendkim

Change default socket path by adding a line like below:

SOCKET="inet:8891@localhost"

Postfix file

Open postfix main config file vim /etc/postfix/main.cf

Add following lines towards end.

# DKIM
milter_default_action = accept
milter_protocol = 2
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891

DKIM Key Generation

Run following commands with mail and example.com matching values used in /etc/opendkim.conf file in earlier step.

opendkim-genkey -t -s mail -d example.com

This command will generate mail.private and mail.txt file. mail.private is private key that will be used to sign outgoing emails. Move it to the location we specified earlier in /etc/opendkim.conf

cp mail.private /etc/postfix/dkim.key

DNS Record Setup

Next, you need to create a TXT record on DNS end. Just check content of mail.txt file created by opendkim-genkey command we ran above.

cat mail.txt

You will see something like below:

mail._domainkey IN TXT "v=DKIM1; k=rsa; t=y; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDYv84GSl0Xp2CrPdFqMZ9ShBDi9Pal9XpfIf7asEENxLRdIka3TONpqtrcCKksROJBNh2G3OVGuoGJ1watQGT46B+zQtjcCI67+WiTlb2D98s1UV3KO7oi/0QH/lH8DzUmrGJUIy3ZBQ9mIu1t6YDyi8y3hlhTILHW7G4HV/VtwQIDAQAB" ; ----- DKIM key mail for example.com

TXT record will require NAMS & VALUE.

Use mail._domainkey for NAME and long string in quotes starting from v=DKIM1 as VALUE.

Below is a sample screenshot for a TXT record. User-interface on your end might differ.

TXT-DKIM record-1

If you are editing a previous DNS record, it might take sometime for changes to propogate.
Start Signing

Once al config & setup done, you need to start DKIM service and restart postfix.

service opendkim start
service postfix restart

Testing DKIM setup for correctness

Anything we do, specially for first time, must end with successful testing!

There are many tools for testing. I will mention few of them below.
Verify DNS Records for DKIM Setup

This will ONLY verify if your TXT record is created successfully.
dig command

Classic and easy. You must be having this already. Running…

dig mail._domainkey.example.com TXT

should return a response like…

;; ANSWER SECTION:
mail._domainkey.exmaple.com. 86400 IN TXT "v=DKIM1\;" "k=rsa\;" "t=y\;" "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDYv84GSl0Xp2CrPdFqMZ9ShBDi9Pal9XpfIf7asEENxLRdIka3TONpqtrcCKksROJBNh2G3OVGuoGJ1watQGT46B+zQtjcCI67+WiTlb2D98s1UV3KO7oi/0QH/lH8DzUmrGJUIy3ZBQ9mIu1t6YDyi8y3hlhTILHW7G4HV/VtwQIDAQAB"

Web-based Record Check

You can use http://www.protodave.com/tools/dkim-key-checker/

Use selector mail and domain example.com there.
Verify DKIM Signing
Test #1 – Email-based

If you have setup keys correctly then you should pass this test.

You can test by simply sending an email to autorespond+dkim@dk.elandsys.com or check-auth2@verifier.port25.com

It’s better to use swaks tools for mail-testing (apt-get install swaks).

swaks -t check-auth2@verifier.port25.com -f me@example.com

Replace me@example.com with your mail id where you would like to receive test results.
Test #2 – Web-based

Better choice will be to use a service like http://www.mail-tester.com/ which gives you a temporary email ID and web-interface to see what happens to the email on receiving end!

==Referensi==

* https://easyengine.io/tutorials/mail/dkim-postfix-ubuntu/

==Pranala Menarik==

@@ Line 98: / Line 98: @@
 ==Web-based Record Check==
-You can use http://www.protodave.com/tools/dkim-key-checker/
+Bisa menggunakan
-Use selector  mail and domain example.com there.
+ http://www.protodave.com/tools/dkim-key-checker/
 ==Verify DKIM Signing==

← Older revision		Revision as of 02:41, 4 October 2019
Line 68:		Line 68:

	Gunakan mail._domainkey untuk NAME dan long string yang dimulai dari v=DKIM1 as VALUE.		Gunakan mail._domainkey untuk NAME dan long string yang dimulai dari v=DKIM1 as VALUE.
−
−	~~Below is a sample screenshot for a TXT record. User-interface on your end might differ.~~

	==Start Signing==		==Start Signing==

← Older revision		Revision as of 23:08, 3 October 2019
Line 126:		Line 126:

	==Pranala Menarik==		==Pranala Menarik==
		+
		+	* [[Postfix]]

@@ Line 2: / Line 2: @@
-DKIM with Postfix
+Jika web-server / webapp anda punya masalah delivery, DKIM (DomainKeys Identified Mail) kemungkinan akan bisa menolong.
-If mails from your web-server/webapp is having delivery issues, DKIM (DomainKeys Identified Mail) can help you big time.
+Sangat di sarankan untuk menggunakan DKIM untuk outgong email meskipun server kita tidak menjalankan mail hosting sama sekali.
 ==Install DKIM==
@@ Line 15: / Line 13: @@
 ==DKIM config==
-Open dkim config file vim /etc/opendkim.conf
+Edit
-Add following lines towards end. Make sure you replace example.com with your domain/subdomain.
+ Domain                  example.com
-Domain                  example.com
+Edit
-Next open dkim defaults file vim /etc/default/opendkim
+ vi /etc/default/opendkim
-Change default socket path by adding a line like below:
+ SOCKET="inet:8891@localhost"
-SOCKET="inet:8891@localhost"
+==Postfix konfigurasi==
-Postfix file
+Edit
-Open postfix main config file vim /etc/postfix/main.cf
+ vi /etc/postfix/main.cf
-Add following lines towards end.
+Tambahkan
-# DKIM
+ # DKIM
-milter_default_action = accept
+ milter_default_action = accept
-milter_protocol = 2
+ milter_protocol = 2
-smtpd_milters = inet:localhost:8891
+ smtpd_milters = inet:localhost:8891
-non_smtpd_milters = inet:localhost:8891
+ non_smtpd_milters = inet:localhost:8891
-DKIM Key Generation
+==DKIM Key Generation==
-Run following commands with mail and example.com matching values used in /etc/opendkim.conf file in earlier step.
+Jalankan perintah berikut dengan mail dan example.com matching dengan yang digunakan /etc/opendkim.conf
-opendkim-genkey -t -s mail -d example.com
+ opendkim-genkey -t -s mail -d example.com
-This command will generate mail.private and mail.txt file. mail.private is private key that will be used to sign outgoing emails. Move it to the location we specified earlier in /etc/opendkim.conf
+Akan keluar 2 file mail.private dan mail.txt.
-cp mail.private /etc/postfix/dkim.key
+ cp mail.private /etc/postfix/dkim.key
-DNS Record Setup
+==DNS Record Setup==
-Next, you need to create a TXT record on DNS end. Just check content of mail.txt file created by opendkim-genkey command we ran above.
+Buat TXT record di DNS. Isinya ada di mail.txt, coba lihat menggunakan
-cat mail.txt
+ cat mail.txt
-You will see something like below:
+Isinya kira-kira,
-mail._domainkey IN TXT "v=DKIM1; k=rsa; t=y; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDYv84GSl0Xp2CrPdFqMZ9ShBDi9Pal9XpfIf7asEENxLRdIka3TONpqtrcCKksROJBNh2G3OVGuoGJ1watQGT46B+zQtjcCI67+WiTlb2D98s1UV3KO7oi/0QH/lH8DzUmrGJUIy3ZBQ9mIu1t6YDyi8y3hlhTILHW7G4HV/VtwQIDAQAB" ; ----- DKIM key mail for example.com
+ mail._domainkey IN TXT "v=DKIM1; k=rsa; t=y;  p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDYv84GSl0Xp2CrPdFqMZ9ShBDi9Pal9XpfIf7asEENxLRdIka3TONpqtrcCKksROJBNh2G3OVGuoGJ1watQGT46B+zQtjcCI67+WiTlb2D98s1UV3KO7oi/0QH/lH8DzUmrGJUIy3ZBQ9mIu1t6YDyi8y3hlhTILHW7G4HV/VtwQIDAQAB" ; ----- DKIM key mail for example.com
-TXT record will require NAMS & VALUE.
+TXT ini membutuhkan NAME & VALUE.
-Use mail._domainkey for NAME and long string in quotes starting from v=DKIM1 as VALUE.
+Gunakan mail._domainkey untuk NAME dan long string yang dimulai dari v=DKIM1 as VALUE.
 Below is a sample screenshot for a TXT record. User-interface on your end might differ.
-TXT-DKIM record-1
+==Start Signing==
-Once al config & setup done, you need to start DKIM service and restart postfix.
+Start DKIM dan Postfix
-service opendkim start
+ service opendkim start
-service postfix restart
+ service postfix restart
-Testing DKIM setup for correctness
+==Testing DKIM setup for correctness==
 Anything we do, specially for first time, must end with successful testing!
 There are many tools for testing. I will mention few of them below.
 Verify DNS Records for DKIM Setup
 This will ONLY verify if your TXT record is created successfully.
@@ Line 90: / Line 91: @@
 Classic and easy. You must be having this already. Running…
-dig mail._domainkey.example.com TXT
+ dig mail._domainkey.example.com TXT
 should return a response like…
-;; ANSWER SECTION:
+ ;; ANSWER SECTION:
-mail._domainkey.exmaple.com. 86400 IN	TXT	"v=DKIM1\;" "k=rsa\;" "t=y\;" "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDYv84GSl0Xp2CrPdFqMZ9ShBDi9Pal9XpfIf7asEENxLRdIka3TONpqtrcCKksROJBNh2G3OVGuoGJ1watQGT46B+zQtjcCI67+WiTlb2D98s1UV3KO7oi/0QH/lH8DzUmrGJUIy3ZBQ9mIu1t6YDyi8y3hlhTILHW7G4HV/VtwQIDAQAB"
+ mail._domainkey.exmaple.com. 86400 IN	TXT	"v=DKIM1\;" "k=rsa\;" "t=y\;"  "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDYv84GSl0Xp2CrPdFqMZ9ShBDi9Pal9XpfIf7asEENxLRdIka3TONpqtrcCKksROJBNh2G3OVGuoGJ1watQGT46B+zQtjcCI67+WiTlb2D98s1UV3KO7oi/0QH/lH8DzUmrGJUIy3ZBQ9mIu1t6YDyi8y3hlhTILHW7G4HV/VtwQIDAQAB"
-Web-based Record Check
+==Web-based Record Check==
 You can use http://www.protodave.com/tools/dkim-key-checker/
 Use selector  mail and domain example.com there.
 Verify DKIM Signing
-Test #1 – Email-based
+==Verify DKIM Signing==
 If you have setup keys correctly then you should pass this test.
@@ Line 111: / Line 114: @@
 It’s better to use swaks tools for mail-testing (apt-get install swaks).
-swaks -t check-auth2@verifier.port25.com -f me@example.com
+ swaks -t check-auth2@verifier.port25.com -f me@example.com
 Replace me@example.com with your mail id where you would like to receive test results.
 Test #2 – Web-based
 Better choice will be to use a service like http://www.mail-tester.com/  which gives you a temporary email ID and web-interface to see what happens to the email on receiving end!