DomainKeys Identified Mail – DKIM – is a recent attempt to add some sender verification to email. Read more here, here and in the RFC 4871 to get some background info.
If you’re sending any newsletters you really want to be investigating this, if you’re doing anti spam it’s good to start looking at tracking this and really everyone should have DKIM on their domains. Exim recently – as of 4.70 – have decent support for it but CentOS is still on 4.63 thanks to RHEL.
To get a new Exim on your CentOS machine I suggest just using ATrpms who as of writing has 4.71 packages available for Exim and the other bits you need. I needed:
exim-4.71-40.el5.i386.rpm exim-mysql-4.71-40.el5.i386.rpm libspf2_2-1.2.5-5.0.el5.i386.rpm libsrs_alt1-1.0-3_rc1.0.el5.i386.rpm |
As well as the 64bit versions, you can just add ATrpms to your systems but really you should have your own repos and carefully control the packages that goes out to your estate.
Once you have upgraded your stock Exim to these versions – it’s a totally clean and compatible upgrade – configuring Exim to automagically sign outgoing mail with DKIM is pretty easy. We’ll make it so it looks for keys in a specific location based on outgoing mail domain so if you’re a relay for many domains you just need to drop down the certs.
Put the following near the top of our /etc/exim/exim.conf file, this just sets some macros we’ll use later on:
DKIM_DOMAIN = ${lc:${domain:$h_from:}}
DKIM_FILE = /etc/exim/dkim/${lc:${domain:$h_from:}}.pem
DKIM_PRIVATE_KEY = ${if exists{DKIM_FILE}{DKIM_FILE}{0}} |
This will use, based on sender domain, a private key in /etc/exim/dkim/sender_domain.pem. By default exim just logs DKIM verification, doesn’t block any incoming mail I won’t cover doing blocks here just sending.
Next find your remote_smtp transport later in the file and change it to look like this:
remote_smtp: driver = smtp dkim_domain = DKIM_DOMAIN dkim_selector = x dkim_private_key = DKIM_PRIVATE_KEY dkim_canon = relaxed dkim_strict = 0 |
This will make Exim do the DKIM signing on outgoing mail but only if it can find a certificate.
To make the certificates is pretty easy, we’ll use a domain example.com:
$ mkdir /etc/exim/dkim/ && cd /etc/exim/dkim/ $ openssl genrsa -out example.com.pem 1024 $ openssl rsa -in example.com.pem -out example.com-public.pem -pubout -outform PEM |
All that’s left now is to update your dns, sticking to example.com you’d add something like this into your bind zone file the text to add after p= is the stuff you’ll find in the public key called example.com-public.pem in our example:
x._domainkey IN TXT "v=DKIM1\; t=y\; k=rsa\; p=MIGfMA0<snip>AQAB" _domainkey IN TXT "t=y\; o=~\;" |
The x matches up with your dkim_selector in the SMTP transport above. The t=y tells the world you’re still testing your setup so remove that only when you’re all 100% certain it works. The o=~ tells everyone you will sign only some mail. You can make that o=- if all mail from you would be signed.
You can verify your DNS is right like this:
$ dig +short txt x._domainkey.example.com "v=DKIM1\; k=rsa\; p=MIGfMA0<snip>AQAB" |
And finally if you’re sending mail you should now see a header in the mail like this:
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=example.com; s=x; h=From:To:Message-Id:Date; bh=g3zLY<snip>5uGs=; b=fonAB<snip>bceHhQ==; |
Finally you can send an email to check-auth@verifier.port25.com and it will reply with all sorts of test output about your domain including DKIM validation details.
