1 Topic by vbconz

  • vbconz
  • Member
  • Offline
  • Registered: 2013-11-13
  • Posts: 24

Topic: Strict DKIM

Hi,

We are getting hassled with Dmarc messages from google as we use dkim keys for the server, add those to appropriate dns records etc.

However Google says that the dkim isnt strictly aligned as of course the dkim is for mailserver.example.com but the sender is @companyname.com

We can add in private keys etc as per the iRed docs but is a long process to setup dkim for each new client. is there any chance of having dkim setup automatically for a client when a domain is created?
e.g.
- ired server creates a PEM
- it then adds the pem to postfix configs etc.
- it then displays a dkim record to be copy pasted to the dns records? It would add a lot of really cool security to be able to do it automatically.

Thanks
Shane

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,082

Re: Strict DKIM

vbconz wrote:

- ired server creates a PEM
- it then adds the pem to postfix configs etc.
- it then displays a dkim record to be copy pasted to the dns records? It would add a lot of really cool security to be able to do it automatically.

- Amavisd reads the DKIM keys, not Postfix.
- You can use amavisd command line to generate new DKIM keys. FYI: https://docs.iredmail.org/sign.dkim.sig … omain.html
- iRedAdmin-Pro is running as "iredadmin" user, it doesn't have required privilege to create and store dkim keys, also no way to update DNS records automatically.

3 Reply by vbconz

  • vbconz
  • Member
  • Offline
  • Registered: 2013-11-13
  • Posts: 24

Re: Strict DKIM

ZhangHuangbin wrote:
vbconz wrote:

- ired server creates a PEM
- it then adds the pem to postfix configs etc.
- it then displays a dkim record to be copy pasted to the dns records? It would add a lot of really cool security to be able to do it automatically.

- Amavisd reads the DKIM keys, not Postfix.
- You can use amavisd command line to generate new DKIM keys. FYI: https://docs.iredmail.org/sign.dkim.sig … omain.html
- iRedAdmin-Pro is running as "iredadmin" user, it doesn't have required privilege to create and store dkim keys, also no way to update DNS records automatically.

Thanks for that. The inability to SUDO will make that difficult.

I had a mail server software that created the pem, setup records and then gave you a text field to copy into your DNS records manually.  Just one step after setting up the client.

I'm going to look into a bash script or similar and see if it is possible to get to the point it is a single command and then leaves a copyable text on the screen.

A cron script that ran regularly and picked up on new mail boxes would probably work. It could then email postmaster the text for the dns field.