April 3, 2018 Roberto Puzzanghera79 comments
This note concerns the DKIM patch embedded in my combined patch (more info here). This topic is advanced and you can skip it at the beginning.
DKIM provides a method for validating a domain name identity that is associated with a message through cryptographic authentication. The validation technique is based on public-key cryptography: Responsibility is claimed by the signer by adding a domain name to the message and then also affixing a digital signature of it and the message. The value is placed in the DKIM-Signature: header field. The verifier recovers the signer's public key using the DNS, and then verifies the signature.
You are invited to take a look to the man pages starting from dkim(8) and spawn-filter(8).
I would like to address a special thank to Manvendra Bhangui, the author of the DKIM patch, for kindly assisting me during all the configuration.
I will show how to configure qmail-remote to sign your outgoing messages and qmail-smtpd to verify your incoming messages. Eventually, as an alternative, you can decide to set qmail-smtpd to do both things; this configuration is presented towards the bottom of this page.
In any case you have to create the domainkey signature.
Signatures are created using a private key on your system, and verified by a public key stored in the DNS for the email domain.
Before you can sign an email, you must create at least one public/private key pair. You may want to create key pairs for every domain you wish to sign, or use one single signature for all your hosted domains.
First of all download the script (thanks to Joerg Backschues) which we'll use to create the keys and print the DNS record.
cd /usr/local/bin wget http://notes.sagredo.eu/files/qmail/domainkey chmod +x domainkey
Now create the folder which will store all the domainkeys.
mkdir /usr/local/etc/domainkeys
Usage: /usr/local/bin/domainkey [-p] domain [selector] Create domainkey Print domainkey with -p
The script can create the key or print the existing key if used with the -p option.
When you create a key for a domain.net it will be stored in the /usr/local/etc/domainkeys/domain.net folder. The folder will be owned by qmailr (the user running qmail-remote) if you sign at qmail-remote level or vpopmail, which is the user who runs qmail-smtpd, if you decide to sign at qmail-smtpd level. My script changes the owner to qmailr by default
> domainkey domain.net Generating RSA private key, 1024 bit long modulus ......................++++++ ........++++++ e is 65537 (0x10001) writing RSA key TXT record for BIND: default._domainkey.domain.net. IN TXT "v=DKIM1\; k=rsa\; t=y\; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCyzJujXz9EiMat2eDzzLjWuSJ6g4i20FXGluNOmruuCFnVJP1OxurKdt57JZm+6QP2h9IOP0owBMmecXI9qx3CkFrlGSMbJsOEGqXwiTSSttgGmSTPZeNAureyo79spwPc44Ol2ZK2U9gBoDpSQEQdLdtXUreRvs/HyTkzalue2wIDAQAB"
You have to create a TXT record like that in your DNS server. If your Name Server is not bind, google is your friend.
qmail-remote
for signing and qmail-smtpd
for verificationReferences:
spawn-filter
dk-filter
Here is how to modify your /var/qmail/rc
script so that qmail-remote
will sign your outgoing messages:
#!/bin/sh # Using stdout for logging # Using control/defaultdelivery from qmail-local to deliver messages by default exec env - PATH="/var/qmail/bin:$PATH" \ QMAILREMOTE=/var/qmail/bin/spawn-filter \ FILTERARGS=/var/qmail/bin/dk-filter \ qmail-start "`cat /var/qmail/control/defaultdelivery`"
The variable QMAILREMOTE makes qmail
to call spawn-filter
before the message gets queued, which in turn will execute a filter of your choice declared by FILTERARGS. For individual domain level control it is best using the control file filterargs
(man spawn-filter
). You can use QMAILLOCAL to sign local deliveries as well.
dk-filter
uses /var/qmail/control/domainkeys/%/default
as the location of the key. The '%' symbol is automatically replaced with the sender's domain. Of course you can decide to sign all your domains with one single signature located in /var/qmail/domainkeys/default
.
If you need to store your domainkey elsewhere, define DKIMSIGN as follows (before the last qmail-start
command):
DKIMSIGN=/usr/local/etc/domainkeys/example.net/your_keyname
Insert the two following environment variables in your /var/qmail/supervise/qmail-smtpd/run script:
export QMAILQUEUE=/var/qmail/bin/qmail-dkim export DKIMVERIFY="FGHKLMNOQRTVWjpu" # This is to avoid verification of outgoing messages export RELAYCLIENT_NODKIMVERIFY=1
Declaring RELAYCLIENT_NODKIMVERIFY avoids that qmail-dkim will verify outgoing messages.
You are invited to read the qmail-dkim man page in order to choose the best configuration for you.
Create a test message to be used in the tests below (it's important to exit with ctrl+d and that the first line is not empty):
# cat > /tmp/testmail.txt To: someone@somewhere.xy From: postmaster@yourdomain.xy Subject: DKIM Test Message Test message FOLLOWING A BLANK LINE cntrl-D
We'll do the test as qmailr, the user who runs qmail-remote and which owns the domainkey.
# su qmailr # declare -x QMAILREMOTE=/var/qmail/bin/spawn-filter # declare -x _SENDER=postmaster@yourdomain.xy # /var/qmail/bin/dk-filter < /tmp/testmail.txt DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=yourdomain.xy; s=default; h=To:From:Subject; bh=lrIChgTwMnmPKfGEgElIyJgL9jk=; b=LQPayl6VbbITdGjVC6vx2+bYF27jAjAkR6qm967GMd1L+0hb7szwP9cDfvy738 Y05llEnOqMrc1QbGGE9uLxqGQrkOAPhl0q+Hxt8yQz1B4BsVk8vED812K/178pIe f+4oGrnodNCCJwg97TLXJmVdecGbrmOVPiBfm51kl4nSI= To: someone@somewhere.xy From: postmaster@yourdomain.xy Subject: DKIM Test Tessage Test message FOLLOWING A BLANK LINE
Send to yourself a message and look for the DKIM signature in the header:
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=yourdomain.xy; s=private; x=1298156019; h=to:from:subject; bh=tVrwKZaEzYO4qmI9mPfR04ZvZik=; b=r2VH/6rQdY6xcPjyg55ULnf7U+DEs +apecicwvygIZVvQwxU4NqiqAQGTF3Qkft2eBDu42TBzX4nV7FTs8wzn40iGkfhB mMZhQdcyOseg7DyOFKUK5D8Ji3ueF/xgYFUnffrxPdZUMpGN9+dA9fY0wkonp5ML dDSaNje9mmd34I=
I assume that vpopmail
is the user who runs qmail-smtpd
.
# su vpopmail # declare -x DKIMQUEUE=/bin/cat # unset RELAYCLIENT # /var/qmail/bin/qmail-dkim < /tmp/testmail.txt DKIM-Status: no signatures To: someone@somewhere.net From: postmaster@yourdomain.xy Subject: DKIM Test Message Test message FOLLOWING A BLANK LINE
Send a message to yourself from a gmail.com account (which is DKIM signed) and check the header. The message has been verified if you get a header like this:
DKIM-Status: good
Finally, send an email to check-auth@verifier.port25.com with "test" as subject. They will send you back a reply with the test results and you will know if your DNS configuration is ok.
[If you didn't install simscan
yet skip this and come here later. qmail
won't work with this directive without simscan
installed.]
As you probably know, also simscan
needs to call qmail-queue
and must be included in the QMAILQUEUE environment variable, just as qmail-dkim
. The same should happen with other qmail scanners.
The work around is to assign qmail-dkim
to QMAILQUEUE and assing simscan
to the DKIMQUEUE variable. In this case qmail-dkim
will call simscan
when has finished its work.
You have to modify like this your /var/qmail/supervise/qmail-smtpd/run
script (and /var/qmail/supervise/qmail-submission/run
as well)
export QMAILQUEUE=/var/qmail/bin/qmail-dkim export DKIMQUEUE=/var/qmail/bin/simscan
You can skip this paragraph if you have already decided to sign at qmail-remote
level.
Insert the two following environment variables in your /var/qmail/supervise/qmail-smtpd/run script:
export QMAILQUEUE=/var/qmail/bin/qmail-dkim export DKIMKEY=/usr/local/etc/domainkeys/%/default
qmail-dkim will sign your messages if the variable RELAYCLIENT is set (take a look at your tcp.smtp) and will verify all messages from IPs where RELAYCLIENT is not set.
DKIMKEY is the location of the key. The '%' symbol is automatically replaced with the sender's domain. Of course you can decide to sign all your domains with one single signature located in /usr/local/etc/domainkeys/default
# cat > /tmp/testmail.txt To: someone@somewhere.xyz From: postmaster@yourdomain.xyz Subject: Test Message Test message FOLLOWING A BLANK LINE THAT YOU DON'T HAVE TO FORGET cntrl-D
In this test qmail-dkim assumes that the domainkey is stored in the /var/qmail/control/domainkeys folder, so if your domainkeys are stored elsewhere create a symbolic link.
# su vpopmail # declare -x DKIMQUEUE=/bin/cat # declare -x DKIMKEY=/usr/local/etc/domainkeys/%/default \ # declare -x RELAYCLIENT="" # /var/qmail/bin/qmail-dkim < /tmp/testmail.txt DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=yourdomain.xyz; s=default; x=1298483339; h=To:From:Subject; bh=6rJdFs2WVS8T72i61KhaAvC6O6s=; b=ffnXBB98Gg6iZFEIL6alk8c5davso ozyrunXM3C8qaejIrJOwYhnlWQwSdrV599WErmJcDYyMjFjVgLzRQ9OTeYHjEnHT X/aiIkvjcxRuOaTK7PcwrcJGdtF0c6LWoK9RgiPctCw7DMcHGmUcSyXWc6ayzHgX A7nopQYuHzTuIU= To: someone@somewhere.xyz From: postmaster@yourdomain.xyz Subject: Test Message Test message FOLLOWING A BLANK LINE THAT YOU DON'T HAVE TO FORGET
If RELAYCLIENT is defined and both DKIMSIGN and DKIMVERIFY are not defined then qmail-dkim looks for DKIMKEY for the private key to sign. If DKIMKEY is not defined, then control/domainkeys/%/default is used
If RELAYCLIENT is not defined, then qmail-dkim uses DKIMSIGN for the key
If the key has % in the filename, then it is replaced with the domain name from the From/Sender header. After substituting %, if the private key is not found, the qmail-dkim removes the % and again checks for the key. e.g. strace shows this
access("control/domainkeys/mydomain.org/default", F_OK) = -1 ENOENT (No such file or directory) open("control/domainkeys/default", O_RDONLY|O_NONBLOCK) = 5
If the key has % in the filename and the private key does not exists, then qmail-dkim exits without signing and without any failure. Hence messages will pass through. The reason for this behaviour is i have many clients who run multiple domains on a server and they need DKIM only for few domains.
If the key does not have % sign and the private key does not exist, then qmail-dkim exits with 32 resulting in permanent failure
"Private key file does not exist (#5.3.5)"
If none of the variables RELAYCLIENT, DKIMSIGN, DKIMVERIFY are defined, qmail-dkim does verification
patch of multilog file size limit
April 6, 2018 20:55
patch of multilog file size limit
April 6, 2018 12:35
Modified of qmailctl
April 4, 2018 11:43
Modified of qmailctl
April 4, 2018 02:17
Reason 3 aliases needed
March 25, 2018 14:33
Reason 3 aliases needed
March 25, 2018 14:22
roundcube plugin for change password and set vacation message in qmailadmin cgi-module
March 18, 2018 09:15
imap-login: Info: Aborted login (no auth attempts in 0 secs): user=<>, rip=#.#.#.#, lip=#.#.#.#, session=
February 20, 2018 15:58
Tags
apache clamav dkim dovecot ezmlm fail2ban hacks lamp letsencrypt linux linux-vserver mariadb mediawiki mozilla mysql owncloud patches php proftpd qmail qmailadmin rbl roundcube rsync sieve simscan slackware spamassassin ssh ssl surbl tcprules tex ucspi-tcp vpopmail vqadmin
Comments
mails do not have a signature via php
Chava2b September 20, 2017 18:00
Hi,
I have in the file /var/qmail/supervise/qmail-smtpd/run
The dkim signature is present if I use outlook for example (relay) but is not present if I send a mail by a php script from the mail server.
Have I forgotten anything? Thank you for your help
regards
Reply | Permalink
Re: mails do not have a signature via php
Roberto Puzzanghera September 20, 2017 21:49
I have never tested this, as I usually run php in a server that is separeted from qmail. As you know, the php mailer calls the sendmail program, which is an alias of /var/qmail/bin/sendmail. Perhaps the qmail's sendmail program injects the message directly via qmail-inject without opening a connection to qmail-smtpd on port 25 and without the call of any filter like qmail-dkim, but I admit that I didn't look at the code, so any other explaination would be welcome
Reply | Permalink
How can I use this patch only and not all the package ?
Pablo Murillo March 2, 2017 00:34
Hi
I'm FreeBSD user, and I don't use netqmail, Is there a way to only implement DKIM patch and not all the others ?
Reply | Permalink
Sorry Pablo, I can't get what
roberto puzzanghera March 7, 2017 22:36
Sorry Pablo, I can't get what you mean.. you say that you don't use netqmail but that is a patch for netqmail...
Reply | Permalink
How to sign with algorithm rsa-sha256
Daniel Prosser August 23, 2016 03:19
I hope this isn't a stupid question. I've got qmail signing outgoing email, but they're all using rsa-sha1. How can get it to use rsa-sha256?
Reply | Permalink
As I suspected, it was a
Daniel Prosser August 23, 2016 19:09
As I suspected, it was a stupid question. I checked out my version of openssl and it didn't have sha256 available. The man page for openssl dgst recommended using SHA1, it was so old. I'm currently building a newer version from source.
Reply | Permalink
Fails to verify if subject not in h= list
C Pitchford February 16, 2016 14:16
I've noticed that Sky UK is sending out legitimate emails including a dkim signature that does NOT include the subject:
I don't think excluding the subject from the signature is against the spec, even if it is silly. It does, however, fail verification
I've added this option to qmail-dkim.c to relax this restriction:
This value ensures it will permit a signature that does not include the subject
It may be worth making this configurable (with an environment variable or a switch to DKIMVERIFY?)
Reply | Permalink
Re: Fails to verify if subject not in h= list
Manvendra February 17, 2016 05:47
Thank you. It is a simple fix. Will have the environment variable UNSIGNED_SUBJECt and let Robert know the url for the latest patch
Reply | Permalink
Re: Fails to verify if subject not in h= list
Manvendra March 7, 2016 07:59
Two New patch uploaded to https://sourceforge.net/projects/indimail/files/netqmail-addons/qmail-dkim-1.0/
One which includes spf + ipv6 + dkim
and one which has only dkim
Reply | Permalink
Re: Fails to verify if subject not in h= list
roberto puzzanghera March 10, 2016 12:37
Thank you Manvendra. I have updated my combined patch accordingly
Reply | Permalink
I will ask Manvendra Bhangui
roberto puzzanghera February 16, 2016 22:11
I will ask Manvendra Bhangui to look at your comment. Thank you
Reply | Permalink
qmail-dkim: signature error: RSA verify failed but testing
Marcello Lupo March 24, 2017 18:02
Hi,
even if I installed the latest patch on my system I'm not able to receive password reset email from GitHub.
I created another account on GitHub using a Gmail account and on that account I receive the email correctly.
Can you help me to understand why on my server it is failing?
These are the DKIM headers i receive on Gmail account for the pasword reset email:
Thank you
Regards
Marcello
Reply | Permalink
Re: qmail-dkim: signature error: RSA verify failed but testing
Manvendra March 25, 2017 04:30
What is the value of your DKIMVERIFY envrionment variable?
In DKIMVERIFY have the letter 'j' included in lower case. Once you have the email in your system, you can test it by supplying the raw text on stdin to dkimtest.
Reply | Permalink
No Output and Exit status 53
Marcello Lupo March 27, 2017 16:22
Hi Manvendra,
if I disable the DKIM on the system the email is received perfectly.
If i pass the raw email to DKIM on the shell i get no output and the exit code is 53 .
If i make the same with a normal gmail email recevide from the server i get the the complete Email on the output with the DKIM-Status: good Header.
Have you any suggestion?
Thank you
Bye
Marcello
Reply | Permalink
DKIM Failing [SOLVED]
Marcello Lupo March 27, 2017 17:46
Hi,
I found the problem. It was a Baesyan filter on a FortiMail system in front of my server that was recognizing that email as SPAM and was altering the Subject. When the email reach my server with the Subject altered it fail the DKIM Check. Now without the Subject altered it works perfectly.
Thank you for your availability and sorry if i make you loose some time.
Bye
Marcello
Reply | Permalink
This example implies qmail-dkim man page to be corrected.
Manvendra March 27, 2017 19:00
Problem: Marcelo was receiving an email where the content of the email was changed (in particular the Subject header).
This caused qmail-dkim to issue the following error
The man page states that DKIMVERIFY should have the letter j for returning temporary error and the letter J for issuing permanent error.
It does not mention that if you omit the letter 'j' or the letter 'J', the email will successfully pass through the queue and get delivered.
So should I modify the qmail-dkim patch for this change in the man page. Most of the dkim verification error results because the message gets modified by some filter before qmail-dkim and you could potentially lose email, like Marcelo.
The troubleshooting test that Marcelo was doing also failed because DKIMVERIFY had the small letter 'j'. If he omits the leter 'j', he should get the output along with the DKIM-Status header. My view is that if you do not want to lose emails and you do not have the habit of looking at the logs for temporary errors, the letters 'j' or 'J' should be completely omitted from DKIMVERIFY
Reply | Permalink
glad to know that your problem got fixed
Manvendra March 27, 2017 18:17
That's good news.
However I was surrprised when you were getting error code 53. Maybe you were piping the output to less or more.
if you use the following script as cat instead of /bin/cat then the troubleshooting always works
Reply | Permalink
exit code 53 means that qmail
Manvendra March 27, 2017 17:36
exit code 53 means that qmail-dkim was not able to write to either stdout or stderr. The function die_write() exits with 53. Is it possible to attach the raw email and send it to my private email address? I shoudl be able to debug. I hope there is nothing sensitive in the email.
Reply | Permalink
it seems like you don't have
roberto puzzanghera March 24, 2017 20:42
it seems like you don't have the DKIM correctly configured. Did you perform all the tests suggested in this page? Which one eventually failed?
Please post your run file
Reply | Permalink
I had the DKIM working for
Marcello Lupo March 24, 2017 23:43
I had the DKIM working for years and due to this error i was getting i made the update to your latest patch on today but the problem still persist.
I'm able to receive mail from gmail and other DKIM enabled servers but not this one. I was thinking the it can be related to the UNSIGNED_SUBJECT but i seems not to be this the issue.
Here my run file:
Thank you
Bye
Reply | Permalink
You have the letter 'j' in
Manvendra March 25, 2017 10:52
You have the letter 'j' in DKIMVERIFY. So qmail-dkim will not exit with 100. Have QMAILQUEUE changed temporarily to bypass qmail-dkim and check. If you still do not receive email then it could be something else. If you receive the qmail
After making the above change, save the incoming email to /tmp/mail.txt and you can do the following to troubleshoot
Reply | Permalink
I've been running with the
C Pitchford February 17, 2016 01:19
I've been running with the patch for a few days. Here are some of the domains that seem to be sending these problem signature:
These emails are now being accepted and validated. It looks like a fairly new trend to exclude the subject from the list of headers. I guess paypal is probably the most serious on the list
Reply | Permalink
DKIM DNS Long records Issue
Marcello Lupo November 5, 2015 14:41
Hi,
I found that apple.com, for example, use DNS long records that are splitted in TXT chunks. You can try it doing "dig -t txt mailout2048s._domainkey.apple.com" . My qmail-dkim is failing to check this DKIM signature (google.com is working instead).
Is it possible that qmail-dkim module have problems dealing with this kind of DNS records?
I hope Manvendra Bhangui or someone else can address on this issue.
Thank you
Regards,
Marcello
Reply | Permalink
DKIM DNS Long record issue
Manvendra December 13, 2015 04:58
qmail-dkim does not have an issue with assembling long text records. e.g.
The same result from indimail's dnstxt program (qmail-dkim uses the same function)
Also all emails from apple.com seems to be getting verified. You can send me a raw text of any one email that is not getting verified so that I can investigate.
Reply | Permalink
Raw text
Marcello Lupo December 13, 2015 13:53
Hi Manvendra,
yes I can send raw text email to you but prefer to do it in a PM.
Can you send me you email or let Roberto to give it to me?
Thank you,
Regards,
Bye
Marcello
Reply | Permalink
DKIM Signature problem with emails received from apple.com
Manvendra December 15, 2015 05:42
I have debugged the issue with help of the raw email. There were two issues. The first issue is verifiying if the signature has expired. This is done by using t= and x= tags. Unfortunately, one of the funtions is using an integer variable to compare the timestamps and due to this, the signature is shown as expired. This issue was easy to fix and I have made the changes
The second problem is X-Brightmail-Tracker header inserted below the DKIM-Signature. This causes the signature not to verify. After removing the X-Brightmail-Tracker, I am able to verify the signature as good. This issue can be solved by ignoring headers not present in the h= tag. However, since this part of the code is from ALT-N technologies, I might take some time to add some code to skip such headers. I will get back as soon as possible with a fix. If I cannot find a way to fix this, I can always put a wrapper before calling qmail-dkim to skip headers not present in the h= tag.
Reply | Permalink
Re: DKIM DNS Long records Issue
Manvendra Bhangui November 6, 2015 02:01
Thanks for pointing this out. WIll investigate this during the weekend and come up with a fix in case there is a bug.
Reply | Permalink
qmail-dkim: signature error: permanent dns failure
nic September 8, 2015 12:19
Dear Roberto,
I had just recieved an error "qmail-dkim: signature error: permanent dns failure requesting selector (#5.7.0)" from a remote domain. That domain does not publish any domainkey. My configure is like so
Any idea where i should start to look?
Thanks
nic
Reply | Permalink
the answer is in the qmail-dkim man page
roberto puzzanghera September 30, 2015 19:30
Nic, the answer is in the qmail-dkim man page.. you have to relax the filter if you don't want to reject those kind of msg. The Q letter should be lowercase, but I'm not sure that doing so is a good idea..
Reply | Permalink
wrong password logs
nic June 24, 2015 18:14
Hi Roberto,
I remembered when i was still using Bill's toaster, i have a log of wrong password logins. Is this log available in your version?
It was in /var/log/maillog in Bill's version.
Thanks
nic
Reply | Permalink
yes it is /var/log/maillog
roberto puzzanghera June 24, 2015 18:58
yes it is /var/log/maillog
Reply | Permalink
Many thanks =)
nic June 24, 2015 22:29
Many thanks =)
Reply | Permalink
Authentication-Results
Behnam December 26, 2014 11:40
Hi
I have some questions
Do you know any solution or patch to add Authentication-Results header for dkim and spf to your combind patch?
how can I sign and verify my local mails?
when I set QMAILLOCAL and set the proper permission to private key and public key, I can sucssesfuly sign local mails but I can not verify that mails and it has DKIM-Status: no signatures ( I comment "export RELAYCLIENT_NODKIMVERIFY=1" to verify local mails ).
Thanks
Behnam
Reply | Permalink
I don't know of any patch to
roberto puzzanghera December 26, 2014 12:02
I don't know of any patch to write dkim and/or spf results into that field, but you can see their response in "DKIM-status" and "Received-SPF" respectively.
Reply | Permalink
dkim for local mails not work
Behnam December 25, 2014 20:52
even with set QMAILLOCAL to /var/qmail/bin/spawn-filter in /var/qmail/rc , I can not sign local mails.
and if I set QMAILQUEUE=/var/qmail/bin/qmail-dkim I received "qq temporary problem (#4.3.0)" when sending local mails.
/var/qmail/rc :
qmail-smtpd/run
/var/qmail/control/defaultdelivery
Reply | Permalink
I don't know... your config
roberto puzzanghera December 26, 2014 11:52
It's strange... your config seems to be correct, but there's no need of declaring QMAILLOCAL to have local mails signed.
Have you done the tests suggested toward the bottom of this page? If yes you should try to debug with strace
Reply | Permalink
now sign but not verify
Behnam December 26, 2014 13:09
Thanks for your reply :-)
I found the problem was permission of private key that root user ( owner of qmail-lspawn ) can not read that file.
now my local mails is somethins like this :
( when DKIMVERIFY="FGHKLMNOQRTVWjpu" is set )
( when DKIMVERIFY="FGHKLMNOQRTVWjpu" is not set )
and I hadn't any DKIM-Status in the second mail
Reply | Permalink
can you post your smtpd
roberto puzzanghera December 26, 2014 15:49
can you post your smtpd run file, or at least confirm that DKIMVERIFY and DKIMSIGN are NOT both defined there?
Reply | Permalink
sorry, I see know that the
roberto puzzanghera December 27, 2014 10:02
sorry, I see now that the verification is done, but for an unknown reason the sign is not matched into the message...
The DKIM verification inside the X-Spam-Status field has nothing to do with the qmail patch, as it's written by spamassassin. So you have to declare DKIMVERIFY
Reply | Permalink
Question about run scripts config with simscan
Marc August 21, 2014 17:48
Hello,
after using your guide to install simscan i am a little bit confused about the config of the qmail-smtpd/run and qmail-submission/run scripts. Before Simscan installation you wrote in the DKIM tutorial:
Insert the two following environment variables in your /var/qmail/supervise/qmail-smtpd/run script:
In the description Making qmail-dkim and simscan live together you wrote:
You have to modify like this your /var/qmail/supervise/qmail-smtpd/run script (and /var/qmail/supervise/qmail-submission/run as well)
The question is, why i have to add in the simscan configuration the parameter export DKIMKEY=/usr/local/etc/domainkeys/%/default. I thougt this was covered with the /var/qmail/rc script. Maybe i miss something in my understanding of the how the things work together.
And another question: The export parameters in the qmail-submission/run script should match with all the Export settings in the qmail-submission/run script?
Thanks for helping.
cheers
Reply | Permalink
Hi Marc, thanks for your
roberto puzzanghera August 22, 2014 10:23
Hi Marc, thanks for your contribution.
You can do in both ways. That was the old method, when the signing had to be done at qmail-smtpd level with all the variables declared in the qmail-smtpd run file. But now I'm signing at qmail-remote level, so the variables have to be declared in the rc file.
I'm going to correct this. Thank you
Reply | Permalink
Contents of DKIMSIGN environment variable
Otto Dandenell August 21, 2014 02:04
Hi Roberto,
You should probably make all examples consistent with the default key locations.
In your /var/qmail/rc example script, you have:
But this should instead be:
Same with the Signing test example.
Or as an alternative, point out to the reader that the keys are generated in one path but the script examples assume they have been copied to another path.
I think this is probably what went wrong for the reader who couldn't get his signing to work.
Regards
/ Otto
Reply | Permalink
thanks
roberto puzzanghera August 21, 2014 12:57
Hi Otto, thanks for your contribution.
Corrected. Of course it was a not wanted error and there will surely be other :)
Reply | Permalink
White List form DKIM
Arturo June 5, 2014 18:12
Hi,
I have the following error and would need to receive these e mails.
Jun 5 18:07:09 mail spamdyke[10900]: DENIED_OTHER from: XXXX@undelivered.ovh.net to: ME_MAIL origin_ip: 178.32.228.195 origin_rdns: mo195.mail-out.ovh.net auth: (unknown) encryption: (none) reason: 554_qmail-dkim:_signature_error:_permanent_dns_failure_requesting_selector_(#5.7.0)
Is there any way to include a whitelist domains?
Thanksss :)
Reply | Permalink
unfortunately there's no
roberto puzzanghera June 5, 2014 22:07
unfortunately there's no whitelist functionality in the dkim program. The error suggests a permanent dns error
Reply | Permalink
invalid structure
ss January 22, 2014 08:56
found the solution to the problem, was an issue with the ticketing system
please discard previous comment
thanks
Reply | Permalink
Invalid structure
ss January 22, 2014 08:14
Hello,
First let me thank you for the excellent write up on the qmail installation guide.
I am having a problem where sending mail to only certain users on my mail server are being rejected with the following error:
The mails are being sent from a ticketing system and the problem started to occur recently.
Regards,
ss
Reply | Permalink
qmail-dkim error
Nicholas October 19, 2013 10:01
Hi Roberto,
I am getting alot of the errors below. Seems like the receiving mail server cannot verify the DKIM of the incoming email. Is it right to say that? What can i do to allow this coming email?
message delayed (qmail-dkim: DKIMContext structure invalid for this operation (#4.3.0)): investigations@FBI.GOV from 194.50.9.6
Thanks
nic
Reply | Permalink
what do you have in your
roberto puzzanghera October 19, 2013 13:13
what do you have in your DKIMVERIFY?
Reply | Permalink
export DKIMVERIFY="DEGIJKfh"
Nicholas October 19, 2013 13:37
export DKIMVERIFY="DEGIJKfh"
Reply | Permalink
I don't know exactly what is
roberto puzzanghera October 19, 2013 14:43
I don't know exactly what is causing the error and I'm not sure that it's a regular rejection.
To make tests we need a raw message like that, but in this case you should temporarily disable the verification. Send me it in private if you like
Reply | Permalink
DKIM not sign
Nicholas July 1, 2013 13:09
I had tried to use verifier-feedback@port25.com to check, it came with a neutral result.
In my named.conf i had also added the TXT record
My run file i have
In /var/qmail/control/domainkeys/domain.com folder i have
Am I missing out anything?
Thanks
Nic
Reply | Permalink
RE: DKIM do not sign
roberto puzzanghera July 1, 2013 13:27
Nick, the config seems ok. Did you remember to set the variable RELAYCLIENT in your tcp.smtp?
Reply | Permalink
Thanks for your reply
Nicholas July 3, 2013 09:47
Thanks for your reply.
I have
regards
nic
Reply | Permalink
Apparently your config is
roberto puzzanghera July 3, 2013 10:01
Apparently your config is ok.. are you sure that your loopback IP is working? Try to assing RELAYCLIENT to your LAN and to your public IP as well.
In addition, but that's not so important, you have already exported QMAILQUEUE in your run file, so declaring it in the last line is redundant.
Reply | Permalink
Many thanks again.This box
Nicholas July 3, 2013 12:16
Many thanks again.
This box has only a public IP.
Do i replace 127 with my public IP to do testing?
127.:allow,RELAYCLIENT=""
I had also removed QMAILQUEUE
Reply | Permalink
No, just add one more line
roberto puzzanghera July 3, 2013 12:20
No, just to add add one more line like this:
This will work in case your loopback is not working (just a guess)
Reply | Permalink
Thanks roberto.I had done
Nicholas July 3, 2013 13:12
Thanks roberto.
I had done what you had sugguested. But it is still not working
Thanks
nic
Reply | Permalink
What the tests from the
roberto puzzanghera July 3, 2013 14:11
What the tests from the command line say? Did you check the priviledges of the domain key? I everything is ok I would try to debug with strace. That will show everything
Reply | Permalink
Hi,The tests are identical to
Nicholas July 3, 2013 17:21
Hi,
The tests are identical to your tutorial.
How do i use strace to debug?
Thanks
nic
Reply | Permalink
Tests from the command line
roberto puzzanghera July 3, 2013 22:10
Tests from the command line are ok. It must be a tcp.smtp/QMAILQUEUE issue..
You can save the strace log in this way:
But do not post the log as a comment, because it will be very long. Feel free to contact me in private instead
Reply | Permalink
Thanks.Am i right to strace
Nicholas July 3, 2013 22:39
Thanks.
Am i right to strace /usr/local/bin/tcpserver -v -H -R -l 0 -x /home/vpopmail/etc/tcp.smtp.cdb ?
regards
nic
Reply | Permalink
No, simply the process id of
roberto puzzanghera July 3, 2013 22:51
No, simply the process id of qmai-smtpd
Reply | Permalink
HiI had strace pid 994 which
Nicholas July 3, 2013 23:08
Hi
I had strace pid 994 which is running the process "supervise qmail-smtpd"
I tried sending out an email to gmail. Received the email but nothing is logged.
994 restart_syscall(<... resuming interrupted call ...> <unfinished ...>
Many thanks again
nic
Reply | Permalink
Actually you have to strace
roberto puzzanghera July 3, 2013 23:14
Actually you have to strace the tcpserver process_id which belongs to qmail-smtpd..
Reply | Permalink
Ok.Nothing is logged
Nicholas July 4, 2013 00:35
Ok.
Nothing is logged. Send out a few mails to gmail account and the log shows
27792 accept(3,
regards
nic
Reply | Permalink
Try this way
roberto puzzanghera July 4, 2013 09:39
Also remember that you have to wait for the greetdelay, so don't stop strace immediately..
Reply | Permalink
Nothing at all.. Weird.
Nicholas July 4, 2013 10:10
Nothing at all.. Weird. Outgoing is not stracable? But incoming does. I had send out 5 test mails to gmail and make sure they are delivered before stopping the strace.
The log reads 19151 accept(3,
regards
Reply | Permalink
you have a 300s timeout in
roberto puzzanghera July 4, 2013 10:18
you have a 300s timeout in the rblsmtpd..
Reply | Permalink
Ok.I remove all other
Nicholas July 4, 2013 10:33
Ok.
I remove all other additional.
23694 ? S 0:00 /usr/local/bin/tcpserver -v -H -R -l 0 -x /home/vpopmail/etc/tcp.smtp.cdb -c 20 -u 89 -g 89 0 smtp /var/qmail/bin/qmail-smtpd /home/vpopmail/bin/vchkpw /bin/true
This time round, i sent out 5 test mails each to yahoo and gmail and made sure all 10 mails are received before checking the log
log file reads
23694 accept(3,
If outgoing is not logging, will incoming log helps in my case?
regards
nic
Reply | Permalink
and how you are using strace?
roberto puzzanghera July 4, 2013 10:38
and how you are using strace? I mean which process id?
PS Nic, can we continue this conversation as a private msg? This thread is going to be so long...
Reply | Permalink
qmail-dkim not sign the mail
Jacekalex October 2, 2011 19:57
Hi
I have a problem with qmail-dkim.
The program mails from RELAYCLIENT signs, but not signed messages sent from other hosts that are not in RELAYCLIENT, and were sent using SMTP-AUTH.
I found the solution to the problem at:
http://qmail.jms1.net/patches/combined-details.shtml
Specifically:
"An example of a patch which needs this functionality, and in fact the initial reason for writing this patch, is the domainkeys patch. In order to verify a signature for an incoming message, it requires that a variable DKVERIFY exist, which contains a list of letters telling which domainkeys results should be considered hard or soft errors. However, in order to sign outgoing messages, it requires that DKVERIFY should NOT exist.
This patch allows me to create an AUTH_SET_DKSIGN environment variable, and when the user AUTH's, it adds a DKSIGN variable to the environment, which forces the qmail-dk program to sign the message instead of verifying it. Without this, the only way to make domainkeys work was to enable it for certain IP addresses in the /etc/tcp/smtp.cdb file, which was no good for clients who used AUTH in order to relay."
Can I count on the fact that a similar mechanism appears in Your patch?
Cheers
:)
Reply | Permalink
qmail-dkim not sign the mail
Cprogrammer August 15, 2013 15:06
Jacekalex ,
you could do the following. Write a dkim shell wrapper as below
and have the above shell script defined in QMAILQUEUE instead of qmail-dkim
Reply | Permalink
Re: qmail-dkim
roberto puzzanghera October 2, 2011 20:27
Hi Jacekalex,
qmail-dkim will sign your messages if the variable RELAYCLIENT is set and will verify all messages from IPs where RELAYCLIENT is not set (but only if you set DKVERIFY). So this is exactly how it should work.
The mechanism of the patch included in the John Simpson's combined patch is different from the one of the DKIM patch authored by Manvendra Bangui and embedded in my big one, as the signing is not triggered by the authentication here.
For any further info and/or troubleshooting do not hesitate to contact me in private, in you like.
Cheers
Edit:
I assume, if you are using my patch, that you have
in your supervise/qmail-submission/run script as well
Concerning the signing after the smtp-auth, it's not clear to me what you mean by "sent by hosts that are not in RELAYCLIENT". Infact, once authenticated, the sender has the IP of the server, so if 127.0.0.1 has RELAYCLIENT it is going to sign the email..
Reply | Permalink
Hi I have a different,
Jacekalex October 3, 2011 20:28
Hi
I have a different, simpler idea.
Why qmail-dkim should check and parse RELAYCLIENT 5 or ~ 20 different IP addresses, since exactly the same thing does qmail-smtpd?
I have 2 questions:
I'm not a C programmer, all my experience, this short script in the shell or perl.
Where - where in the qmail-smtpd.c, and in what form (int, void, other), add a piece of code:
Why this code?
Depending on the AUTH || RELAYCLIENT, SIGNMAIL variable will have value 1 or 0
Then in the qmail-dkim going to remove a function
and give their own in the shape similar to:
A precisely if $SIGNMAIL = 1 then dkimsign else dkimverify.
In my opinion a much simpler solution, and certainly feasible.
Any suggestions very welcome.
Cheers ;)
Reply | Permalink
Hey Jacekalex, I double
roberto puzzanghera October 4, 2011 18:03
Hey Jacekalex, I double checked my configuration and inside my tcp.submission I simply have:
and my outgoing emails from submission port 587 are signed. No need to put RELAYCLIENT if the client is authenticated.
I don't have the time to study qmail-dkim.c to see where it happens, but the program proves to act as you like.. :-)
Reply | Permalink
Thanks For me I do not want
Jacekalex October 4, 2011 18:21
Thanks
For me I do not want at this moment to sign mail with the authorization of the hosts! RELAYCLIENT, try again to compile the entire qmail, if this does not help, then he'll write a function to the Qmail-scanner, which will sign a check and mails, if need be, then I'll be able to sign up to create a rule in the sql;)
I'm not a C programmer, but in Perl I can cope quite well, and such a function to check or signing with the use of / var / qmail / bin / dkimtest - these are just a few (maybe several) lines of fairly simple code in qmail-scanner, and a little in qmail . c (qq error status).
Cheers
;)
Reply | Permalink
Why qmail-dkim should check
roberto puzzanghera October 4, 2011 00:29
thanks for the contribution, Jacekalex. Unfortunately I've never inspected the code of the DKIM patch. You may want to refer to the author
Concerning the first part of your question, you can include just the 127.0.0.1 which counts for all the IPs which do the smtp-auth and use subnets..
cheers
Reply | Permalink
Let me know what change I should make
Cprogrammer July 8, 2013 06:04
Just stumbled upon this post. The thread is long and I will read all the posts when I get time.
Reply | Permalink