Assuming you are using iRedOS, and the domain is xyz.com:
1. Generate the new key.

cd /var/lib/dkim/
amavisd genrsa xyz.com.pem
chmod 0644 xyz.com.pem

2. Add it to your amavisd.conf file:
Search for "# Add dkim_key here.", and add it alongside the others, preferably in alphabetic order so you can find it faster.

dkim_key("xyz.com", "dkim", "/var/lib/dkim/xyz.com.pem");

3. Add your new domain to @local_domains_maps in amavisd.conf. The line should now read something like this:

@local_domains_maps = ( [".$mydomain", "firstdomain.com", "xyz.com"] );  # list of all local domains

4. Restart amavisd

/etc/init.d/amavisd restart

5. Test that the key was installed properly

 amavisd showkeys xyz.com

The output should be something like this:

; key#1, domain xyz.com, /var/lib/dkim/xyz.com.pem
dkim._domainkey.xyz.com.   3600 TXT (
  "v=DKIM1; p="
  "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDEzgjyG2It0ZdQQTgGNj2jNDKe"
  "fsa978sd98fsd9vds97v9fHIUSAFHY(#@*oiu7cs98a9"
  "afljhljoU(*@#&($*#@U9ujw9fewur0932870932"
  "jvAe33lH9tiVljog1QYSUDOEAaads")

6. Add exactly what was printed above to the zone file in you nameserver(s). You should also include SPF and ADSP. For example:

xyz.com.    IN TXT    "v=spf1 +a +mx ~all"
dkim._domainkey.xyz.com.   3600 TXT (
  "v=DKIM1; p="
  "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDEzgjyG2It0ZdQQTgGNj2jNDKe"
  "fsa978sd98fsd9vds97v9fHIUSAFHY(#@*oiu7cs98a9"
  "afljhljoU(*@#&($*#@U9ujw9fewur0932870932"
  "jvAe33lH9tiVljog1QYSUDOEAaads")
_adsp._domainkey.xyz.com. IN    TXT    "dkim=all"

Make sure you have also updated the serial of the zone file.
Then restart named service:

/etc/init.d/named restart

7. Verify that everything is ok by sending mails from xyz.com to the autoresponders from this page:
DKIM Reflectors.

No problemo.

Just a minor note: if you look at the SPF entry, I put "~all" instead of "-all" (tilde instead of minus), that's a soft-fail instead of hard-fail. This means email originating from another SMTP gateway or IP address will still be accepted by 3rd parties (instead of being discarded), but it should have a high spam score. If the 3rd party server is working properly, that is...

I did that because some of my users send emails directly from a mini-SMTP server to monitor an industrial machine for example.

Hi

Sorry for revisiting an old thread - but these are the instructions I followed. I have just installed version 0.51 on Ubuntu 8.04. Great product!

I have set up dkim as suggested but validation fails

Here is the output from amavisd showkeys

:/var/lib/dkim# amavisd-new showkeys artsoafrican.co.uk
; key#1, domain artsoafrican.co.uk, /var/lib/dkim/artsoafrican.co.uk.pem
dkim._domainkey.artsoafrican.co.uk.    3600 TXT (
  "v=DKIM1; p="
  "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDIH6Sba7TxrwXR7hMm3RTmRwKh"
  "wfX8O7iDO/7W3lXFRlAzlZzfolYBfnE3fUZiGwL89zCUiIcx5d9br577a0kZth0C"
  "hT3bOSVq+BbcujH/APWLAXCXLohnAX717gQxdMeopE21nrJIB8HuOOciRE5PdLco"
  "EzeZJLHCDVX8jBcClwIDAQAB")

My DNS is set up as in the attached screenshot. I also tried this with stripping out all the quotes and linefeeds etc.

When I run testkeys I get:

TESTING#1: dkim._domainkey.artsoafrican.co.uk => fail (bad RSA signature)

And a test mail to to a reflector shows the ff error:

Authentication System:       DomainKeys Identified Mail
  Result:                   DKIM signature NOT confirmed
  Description:              Signature verification failed; signature is missing or key could not be found
  Reporting host:           sendmail.net        

Hopefully I am missing something obvious - any ideas what?

Thanks for the response. I changed it again last night after using dig to compare my own entry with one I knew worked (ebay) and your query showed the current result. This checks out fine with testkeys. I did add "s=email\; t=s:y" myself as I got this from an online key generator.

I'm still getting the same response from the reflector but I guess I'll have to try again later as their DNS cache may not have been updated yet.

Hi
I am using ISP provider dns, reverse dns is set in there end, in my local machine i configured forward lookup zone,
i pasted dkim this format, but geting error dkim -neutral and if i test dkim- publick key is not available

dkim._domainkey.mydomain.com.      3600 TXT  v=DKIM1; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD2x1tgfarduYD7Nfs9IrDL0IzBWNIC6liXdqoF55mU1muFx2QTccfN+MKG/fNhNfpHxNXRESOoFD8ZDzcpnDekB47U208dBoqnB7C6MW6s1kw2HxnUkjo3p5HH4YfBmKsDpAo3CJIuY+tWz6LHivt32O3qfJ3eIQhwN95S+KuCwIDAQAB
this is what i added, what else should i add here, please some one assist me n this