June 19, 2019 Roberto Puzzanghera128 comments
This note concerns the DKIM patch embedded in my combined patch (more info here). This topic is advanced and you can skip it at the beginning.
DKIM provides a method for validating a domain name identity that is associated with a message through cryptographic authentication. The validation technique is based on public-key cryptography: Responsibility is claimed by the signer by adding a domain name to the message and then also affixing a digital signature of it and the message. The value is placed in the DKIM-Signature: header field. The verifier recovers the signer's public key using the DNS, and then verifies the signature.
You are invited to take a look to the man pages starting from dkim(8) and spawn-filter(8).
Mirko Buffoni did a slight modification here which allows to sign messages sent by authenticated users, and to verify all non authenticated ones.
I would like to address a special thank to Manvendra Bhangui, the author of the DKIM patch, for kindly assisting me during all the configuration.
I will show how to configure qmail-remote
to sign your outgoing messages and qmail-smtpd
to verify your incoming messages. Eventually, as an alternative, you can decide to set qmail-smtpd to do both things; this configuration is presented towards the bottom of this page.
In any case you have to create the domainkey signature.
Signatures are created using a private key on your system, and verified by a public key stored in the DNS for the email domain.
Before you can sign an email, you must create at least one public/private key pair. You may want to create key pairs for every domain you wish to sign, or use one single signature for all your hosted domains.
First of all download the script (thanks to Joerg Backschues and to Tatsuya Yokota for the 2048 bit key support) which we'll use to create the keys and print the DNS record.
cd /usr/local/bin wget https://notes.sagredo.eu/files/qmail/domainkey chmod +x domainkey
Now create the folder which will store all the domainkeys.
mkdir /usr/local/etc/domainkeys
Usage: /usr/local/bin/domainkey [-p] domain [selector] Create domainkey Print domainkey with -p
The script can create the key or print the existing key if used with the -p option.
When you create a key for a domain.net it will be stored in the /usr/local/etc/domainkeys/domain.net
folder. The folder will be owned by qmailr
(the user running qmail-remote
) if you sign at qmail-remote
level or vpopmail
, which is the user who runs qmail-smtpd
, if you decide to sign at qmail-smtpd
level. My script changes the owner to qmailr
by default
> domainkey domain.net Generating RSA private key, 1024 bit long modulus ......................++++++ ........++++++ e is 65537 (0x10001) writing RSA key TXT record for BIND: default._domainkey.domain.net. IN TXT "v=DKIM1\; k=rsa\; t=y\; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCyzJujXz9EiMat2eDzzLjWuSJ6g4i20FXGluNOmruuCFnVJP1OxurKdt57JZm+6QP2h9IOP0owBMmecXI9qx3CkFrlGSMbJsOEGqXwiTSSttgGmSTPZeNAureyo79spwPc44Ol2ZK2U9gBoDpSQEQdLdtXUreRvs/HyTkzalue2wIDAQAB"
You have to create a TXT record like that in your DNS server. If your Name Server is not bind
, google is your friend.
qmail-remote
for signing and qmail-smtpd
for verificationReferences:
spawn-filter
dk-filter
rc
scriptHere is how to modify your /var/qmail/rc
script so that qmail-remote
will sign your outgoing messages:
#!/bin/sh # Using stdout for logging # Using control/defaultdelivery from qmail-local to deliver messages by default # DKIM 2048 key sign exec env - PATH="/var/qmail/bin:$PATH" \ QMAILREMOTE=/var/qmail/bin/spawn-filter \ DKIMSIGNOPTIONS="-z 2" \ FILTERARGS=/var/qmail/bin/dk-filter \ qmail-start "`cat /var/qmail/control/defaultdelivery`" # DKIM 1024 key sign #exec env - PATH="/var/qmail/bin:$PATH" \ #QMAILREMOTE=/var/qmail/bin/spawn-filter \ #FILTERARGS=/var/qmail/bin/dk-filter \ #qmail-start "`cat /var/qmail/control/defaultdelivery`" # Use this if you don't want to sign or you're signing at qmail-smtpd level #exec env - PATH="/var/qmail/bin:$PATH" \ #qmail-start "`cat /var/qmail/control/defaultdelivery`"
The variable QMAILREMOTE makes qmail
to call spawn-filter
before the message gets queued, which in turn will execute a filter of your choice declared by FILTERARGS. For individual domain level control it is best using the control file filterargs
(man spawn-filter
). You can use QMAILLOCAL to sign local deliveries as well.
dk-filter
uses /var/qmail/control/domainkeys/%/default
as the location of the key. The '%' symbol is automatically replaced with the sender's domain. Of course you can decide to sign all your domains with one single signature located in /var/qmail/control/domainkeys/default
.
If you need to store your domainkey elsewhere, define DKIMSIGN as follows (before the last qmail-start
command):
DKIMSIGN=/usr/local/etc/domainkeys/example.net/your_keyname
qmail-smtpd/run
scriptInsert the two following environment variables in your /var/qmail/supervise/qmail-smtpd/run
script:
export QMAILQUEUE=/var/qmail/bin/qmail-dkim export DKIMVERIFY="FGHKLMNOQRTVWjpu" # This is to avoid verification of outgoing messages export RELAYCLIENT_NODKIMVERIFY=1
Declaring RELAYCLIENT_NODKIMVERIFY
avoids that qmail-dkim
will verify outgoing messages.
You are invited to read the qmail-dkim
man page in order to choose the best configuration for you.
Create a test message to be used in the tests below (it's important to exit with ctrl+d
and that the first line is not empty):
# cat > /tmp/testmail.txt To: someone@somewhere.xy From: postmaster@yourdomain.xy Subject: DKIM Test Message Test message FOLLOWING A BLANK LINE cntrl-D
We'll do the test as qmailr
, the user who runs qmail-remote
and which owns the domainkey.
# su qmailr # declare -x QMAILREMOTE=/var/qmail/bin/spawn-filter # declare -x _SENDER=postmaster@yourdomain.xy # /var/qmail/bin/dk-filter < /tmp/testmail.txt DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=yourdomain.xy; s=default; h=To:From:Subject; bh=lrIChgTwMnmPKfGEgElIyJgL9jk=; b=LQPayl6VbbITdGjVC6vx2+bYF27jAjAkR6qm967GMd1L+0hb7szwP9cDfvy738 Y05llEnOqMrc1QbGGE9uLxqGQrkOAPhl0q+Hxt8yQz1B4BsVk8vED812K/178pIe f+4oGrnodNCCJwg97TLXJmVdecGbrmOVPiBfm51kl4nSI= To: someone@somewhere.xy From: postmaster@yourdomain.xy Subject: DKIM Test Tessage Test message FOLLOWING A BLANK LINE
Send to yourself a message and look for the DKIM signature in the header:
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=yourdomain.xy; s=private; x=1298156019; h=to:from:subject; bh=tVrwKZaEzYO4qmI9mPfR04ZvZik=; b=r2VH/6rQdY6xcPjyg55ULnf7U+DEs +apecicwvygIZVvQwxU4NqiqAQGTF3Qkft2eBDu42TBzX4nV7FTs8wzn40iGkfhB mMZhQdcyOseg7DyOFKUK5D8Ji3ueF/xgYFUnffrxPdZUMpGN9+dA9fY0wkonp5ML dDSaNje9mmd34I=
I assume that vpopmail
is the user who runs qmail-smtpd
.
# su vpopmail # declare -x DKIMQUEUE=/bin/cat # unset RELAYCLIENT # /var/qmail/bin/qmail-dkim < /tmp/testmail.txt DKIM-Status: no signatures To: someone@somewhere.net From: postmaster@yourdomain.xy Subject: DKIM Test Message Test message FOLLOWING A BLANK LINE
Send a message to yourself from a gmail.com account (which is DKIM signed) and check the header. The message has been verified if you get a header like this:
DKIM-Status: good
Finally, send an email to check-auth@verifier.port25.com with "test" as subject. They will send you back a reply with the test results and you will know if your DNS configuration is ok.
You can also check the validation of your dns record (not the sign verification) here https://mxtoolbox.com/dkim.aspx.
[If you didn't install simscan
yet skip this and come here later. qmail
won't work with this directive without simscan
installed.]
As you probably know, also simscan
needs to call qmail-queue
and must be included in the QMAILQUEUE
environment variable, just as qmail-dkim
. The same should happen with other qmail scanners.
The work around is to assign qmail-dkim
to QMAILQUEUE
and assing simscan
to the DKIMQUEUE
variable. In this case qmail-dkim
will call simscan
when has finished its work.
You have to modify like this your /var/qmail/supervise/qmail-smtpd/run
script (and /var/qmail/supervise/qmail-submission/run
as well)
export QMAILQUEUE=/var/qmail/bin/qmail-dkim export DKIMQUEUE=/var/qmail/bin/simscan
qmail-smtpd
for signing outgoing messagesYou can skip this paragraph if you have already decided to sign at qmail-remote
level.
qmail-smtpd
run scriptInsert the two following environment variables in your /var/qmail/supervise/qmail-smtpd/run
script:
export QMAILQUEUE=/var/qmail/bin/qmail-dkim export DKIMKEY=/usr/local/etc/domainkeys/%/default
qmail-dkim
will sign your messages if the variable RELAYCLIENT
is set (take a look at your tcp.smtp
) and will verify all messages from IPs where RELAYCLIENT
is not set.
DKIMKEY
is the location of the key. The '%' symbol is automatically replaced with the sender's domain. Of course you can decide to sign all your domains with one single signature located in /usr/local/etc/domainkeys/default
# cat > /tmp/testmail.txt To: someone@somewhere.xyz From: postmaster@yourdomain.xyz Subject: Test Message Test message FOLLOWING A BLANK LINE THAT YOU DON'T HAVE TO FORGET cntrl-D
In this test qmail-dkim
assumes that the domainkey is stored in the /var/qmail/control/domainkeys
folder, so if your domainkeys are stored elsewhere create a symbolic link.
# su vpopmail # declare -x DKIMQUEUE=/bin/cat # declare -x DKIMKEY=/var/qmail/control/domainkeys/%/default # declare -x RELAYCLIENT="" # /var/qmail/bin/qmail-dkim < /tmp/testmail.txt DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=yourdomain.xyz; s=default; x=1298483339; h=To:From:Subject; bh=6rJdFs2WVS8T72i61KhaAvC6O6s=; b=ffnXBB98Gg6iZFEIL6alk8c5davso ozyrunXM3C8qaejIrJOwYhnlWQwSdrV599WErmJcDYyMjFjVgLzRQ9OTeYHjEnHT X/aiIkvjcxRuOaTK7PcwrcJGdtF0c6LWoK9RgiPctCw7DMcHGmUcSyXWc6ayzHgX A7nopQYuHzTuIU= To: someone@somewhere.xyz From: postmaster@yourdomain.xyz Subject: Test Message Test message FOLLOWING A BLANK LINE THAT YOU DON'T HAVE TO FORGET
DKIMSIGN
and DKIMKEY
qmail-dkim(8)
for more infoIf RELAYCLIENT
is defined and both DKIMSIGN
and DKIMVERIFY
are not defined then qmail-dkim
looks for DKIMKEY
for the private key to sign. If DKIMKEY
is not defined, then control/domainkeys/%/default
is used
If RELAYCLIENT
is not defined, then qmail-dkim
uses DKIMSIGN
for the key
RELAYCLIENT
is not defined and both DKIMSIGN
and DKIMVERIFY
is defined, then qmail-dkim
ignores DKIMVERIFY
If the key has % in the filename, then it is replaced with the domain name from the From/Sender header. After substituting %, if the private key is not found, the qmail-dkim
removes the % and again checks for the key. e.g. strace shows this
access("control/domainkeys/mydomain.org/default", F_OK) = -1 ENOENT (No such file or directory) open("control/domainkeys/default", O_RDONLY|O_NONBLOCK) = 5
If the key has % in the filename and the private key does not exists, then qmail-dkim
exits without signing and without any failure. Hence messages will pass through. The reason for this behaviour is i have many clients who run multiple domains on a server and they need DKIM only for few domains.
If the key does not have % sign and the private key does not exist, then qmail-dkim
exits with 32 resulting in permanent failure
"Private key file does not exist (#5.3.5)"
If none of the variables RELAYCLIENT
, DKIMSIGN
, DKIMVERIFY
are defined, qmail-dkim
does verification
markasjunk skin not working
December 9, 2019 08:08
usage 2048 keys
December 8, 2019 14:06
chkuser
December 8, 2019 09:46
chkuser
December 7, 2019 23:10
usage 2048 keys
December 7, 2019 07:54
usage 2048 keys
December 7, 2019 05:33
usage 2048 keys
December 7, 2019 05:28
markasjunk skin not working
December 6, 2019 13:53
markasjunk skin not working
December 6, 2019 06:39
chkuser
December 4, 2019 01:34
Tags
apache clamav dkim dovecot ezmlm fail2ban hacks lamp letsencrypt linux linux-vserver lxc mariadb mediawiki mozilla mysql owncloud patches php proftpd qmail qmailadmin rbl roundcube rsync sieve simscan slackware spamassassin ssh ssl surbl tcprules tex ucspi-tcp vpopmail vqadmin
Comments
SPF, DKIM and DMARC
Christian October 28, 2019 08:25
I would really recommend to set up the full stack: SPF, DKIM, and DMARC. No one should send emails without having this configuration ready. The mentions tools in the article to verify DKIM are great, but for this purpose, I use another free tool from https://www.emailchecky.com/en/ because it has more features and also offers a very handy all-in-one analysis for emails.
Reply | Permalink
SPF, DKIM and DMARC
Roberto Puzzanghera Christian October 28, 2019 10:09
These topics are all covered here, DMARC is presented in the spamassassin section, SPF is inside the Configuring page.
If I understand the scarse documentation of the page you suggest, this tool seems just like an external tool where to redirect private msg and personal data in order to validate the email. Not a good idea.
Reply | Permalink
DMARC
Iulian August 12, 2019 11:24
Hello,
I know this topic is reserved for DKIM but do you intend to write something about DMARC as well?
Did you found any posibility to implement DMARC? Apparently there is something possible with qpsmtp and opendmarc , a plugin support in spamassassin(i find it in a very incipent way) or implemented via spamassassin AskDNS like it's presented on my blog.
Do you have any other ideeas?
Reply | Permalink
DMARC
Roberto Puzzanghera Iulian September 18, 2019 17:05
Finally I added a page on DMARC with AskDNS here. Thanks for your contribution
Reply | Permalink
DMARC
Martin Iulian August 12, 2019 22:57
Hi Iulian,
I implemented a DMARC filter for incoming mails; maybe it's of use to you: https://github.com/fany/App-Qmail-DMARC
Regards
Martin
Reply | Permalink
DMARC
Roberto Puzzanghera Iulian August 12, 2019 17:24
I don't have plans to write anything concerning DMARC filters, as I'm not familiar with them yet.
Anyway I would not consider qpsmtp as a good option, since I don't like the idea of completely replace my qmail-smtpd. I would play with a spamassassin plugin like the one that you suggest in your blog, when I'll have the time
Reply | Permalink
PID Process with DKIM + Simscan
Carlos Garcia June 28, 2019 10:32
Hello,
I've noticed that when chaining dkim with simscan the pid of the process changes in simscan.
This is bad when it comes to processing the logs
Any ideas?
Regards
Reply | Permalink
PID Process with DKIM + Simscan
Roberto Puzzanghera Carlos Garcia June 28, 2019 18:02
This is because simscan goes in a sub-process. the simscan pid is bounded to its parent ppid in the email header, for example
Reply | Permalink
dk-filter: choosing the signing domain
Martin Sluka June 23, 2019 19:33
I don't get it: dk-filter states: "dk-filter uses the domain found in the Sender: header to set the domain tag. If not it uses the From: header."
But when I test it and also when reading its code, I find no evidence that the From: header would ever be considered. Thus, bounce messages do not get signed, which according to my understanding of RFC 7489 they should for a correct DMARC alignment.
In fact, when _SENDER is empty, dk-filter seems to use /var/qmail/control/domainkeys/default if present. However, this also does not work as intended, because "d=" has en empty value then, and forwarded bounce messages from foreign domains will also get signed, which is obviously not desirable.
Am I holding it wrong, or is the documentation / code just incorrect?
Regards
Martin
Reply | Permalink
dk-filter: choosing the signing domain
Manvendra Bhangui Martin Sluka June 24, 2019 15:54
Ah. I see what you meant by the following
"I don't get it: dk-filter states: "dk-filter uses the domain found in the Sender: header to set the domain tag. If not it uses the From: header."
But when I test it and also when reading its code, I find no evidence that the From: header would ever be considered. Thus, bounce messages do not get signed, which according to my understanding of RFC 7489 they should for a correct DMARC alignment."
For bounce messages, since the from/sender will be null, you can set the DKIMDOMAIN environment variable in the script which starts up qmail-send. DKIMDOMAIN also overrides anyting in the From: or Sender: header.
Reply | Permalink
dk-filter: choosing the signing domain
Manvendra Bhangui Manvendra Bhangui June 24, 2019 16:05
I am wrong about DKIMDOMAIN in my earlier reply. DKIMDOMAIN env variable doesn't override the From: or Sender: header value. It is used only if From and Sender are both null (like in case of bounce). Here is the code in dkimsign.cpp
Reply | Permalink
dk-filter: choosing the signing domain
Manvendra Bhangui Martin Sluka June 24, 2019 12:41
dk-filter uses _SENDER, _RECIPIENT env variable which is set by spawn-filter. spawn-filter is a program that gets called by qmail-lspawn when QMAILLOCAL is set to /var/qmail/bin/spawn-filter for local deliveries. It also gets called by qmail-rspawn for remote deliveries when you set QMAILREMOTE env variable to /var/qmail/bin/spawn-filter. the spawn-filter than gathers all information like the sender and recipient. It then calls whatever program is defined by FILTERARGS env variable. The input to FILTERARGS is the original email and the output of the FILTERARGS is fed to qmail-local for local deliveries and qmail-remote for remote deliveries. The real workhorse for DKIM verfication and signing is not the dk-filter program. It is actually the binary /var/qmail/bin/dkim which does the actual work using the libdkim library.
Check out the man pages for spawn-filter, dkim, dk-filter, qmail-lspawn, qmail-rspawn to know more. My documenation may not be good and could use some help there (especially things that you find it wrong or do not understand).
If you set DKIMVERIFY env variable for qmail-send, then dk-filter will not do signing. Hence bounce messages will not get signed. But one can do the following - do DKIM verification for local deliveries and DKIM Signing for remote deliveries by having two entires in /var/qmail/control/filterargs
In my setup, I do DKIM verification during the SMTP transaction and DKIM signing during remote deliveries.
Maybe you could describle what you want to achieve with examples and I could work out a solution which will work for you
Reply | Permalink
dk-filter: choosing the signing domain
Martin Sluka Manvendra Bhangui June 24, 2019 21:10
Hi Mandreva,
thanks for your answers!
What I am trying to achieve is that all outgoing e-mail which has our domain in its RFC5322.From address (and thus a corresponding /var/qmail/control/domainkeys/$domain/default key file exists) gets a DKIM signature, whereas other messages (e.g. those which came from remote and get forwarded to other remote addresses) are left untouched.
In /var/qmail/supervise/qmail-send/run I have:
In practice this works for "normal" messages, but only because their RFC5322.From is usually identical to their RFC5321.MailFrom address, and the latter is contained in the environment variable _SENDER when dk-filter gets invoked. For bounce messages however, the RFC5321.MailFrom address is empty, thus _SENDER is empty, which causes dk-filter to fall back to /var/qmail/control/domainkeys/default – but then, it cannot correctly distinguish between bounce messages generated by our system and foreign bounce messages which should only get forwarded, but not signed.
So, to cut it short, the IMHO correct solution would be to use the RFC5322.From address for choosing the key, either always or at least when the RFC5321.MailFrom is empty.
According to dk-filter(8), "dk-filter uses the domain found in the Sender: header to set the domain
tag. If not it uses the From: header." What is meant by "If not it uses the From: header"? I understand it as: If there is no sender, then it uses the From: header, that is the RFC5322.From (for choosing the signing key to use). But I cannot see that it would really do that. So either I misunderstand the documentation, or the documentation does not match the actual behaviour of dk-filter.
Or are you trying to explain that the _SENDER environment variable which dk-filter uses to select the key should already be set to the RFC5322.From by a component earlier in the call chain? If yes, which component would that be and how would one achieve this?
BTW, in the meantime I've patched dk-filter to do an appropriate lookup, so it works for me now. I just wonder if there is a better solution.
Reply | Permalink
dk-filter: choosing the signing domain
Manvendra Bhangui Martin Sluka June 26, 2019 10:19
Yes. The _SENDER environment variable which dk-filter uses is already set by spawn-filter earlier in the call chain.
Howerver this is NULL for bounces, eventhough the RFC5233.From will be mailer-daemon@bounce_domain. The bounce_domain will be a value set by qmail-send from /var/qmail/control/me
Looks like I have understood your problem and that problem will be there for all users. There are two issues. The first issue isn't really the blocker. The blocker is the wrong key being used for signing by the dk-filter script when the _SENDER env variable is NULL.
1. the libdkim library uses the following logic
This implies that it uses the envelope from address first for signing the domain. This should be like this
2. The sender/from address comes from the _SENDER environment variable. This variable is set by spawn-filter program
The spawn-filter gets this from the command line arguments passed to qmail-local / qmail-remote by qmail-lspawn, qmail-rspawn respectively. For bounces, this will be NULL. The problem is that dk-filter falls back to using /var/qmail/control/domainkeys/default.
One way to solve this is to use /var/qmail/control/me as the signing domain for bounces as the bounce will be from MAILER-Daemon@. The other solution is to define your default DKIM key in dk-filter rather than using a hardcoded var/qmail/control/domainkeys/default
I am contemplating at using an environment variable DEFAULT_DKIM_KEY which dk-filter will use in such cases. You can set DEFAULT_DKIM_KEY like this
Reply | Permalink
Problem using a selector different than default
Pablo Murillo February 14, 2019 06:01
Hi
Finally I have all working, but I decided not to use "default" as "default" selector
I used domainkey to generate the key
I have in usr/local/etc/domainkeys/my_domain.com
Inside the DNS I added a txt as folow
I'm using qmail-smtpd for signing outgoing messages
The messages are signed, but with the wrong "CNAME"
I sent an email to "auth-results@verifier.port25.com" and I have this answer
Any idea where is the error ?
Reply | Permalink
Problem using a selector different than default
Roberto Puzzanghera Pablo Murillo February 14, 2019 09:38
strange... what happens if you verify your own message with gmail or even your own server?
Reply | Permalink
Problem using a selector different than default
Manvendra Bhangui Roberto Puzzanghera February 14, 2019 18:26
Thank you for bringing this to my attention. I will work on this and provide a fix ASAP. Give me some time till weekend.
Reply | Permalink
Problem using a selector different than default
Pablo Murillo Manvendra Bhangui February 15, 2019 04:19
Hi
Finally I found a solution, not the best, but ...
Check then next post
https://notes.sagredo.eu/en/qmail-notes-185/configuring-dkim-for-qmail-92.html#comment1231
Reply | Permalink
Problem using a selector different than default
Pablo Murillo Roberto Puzzanghera February 14, 2019 17:29
More tests
Now, with my domain
I made few changes to fit my configurations
I changed the location for domainkeys to other folder where I have all the configs
I made a ln -s for /usr/local/etc/domainkeys to the new domainkeys folder
I configured qmail-smtpd for signing outgoing messages
I created a new domainkey for pablomurillo.com.ar with RNAdkim as "selector"
DKIM check details:
-------------------------------------------------------------------------------------------------------------------
Test to gmail:
-------------------------------------------------------------------------------------------------------------------
If I use something different as default for selector don´t work
I checked DKIM on DNS with : https://dkimcore.org/tools/keycheck.html and it's OK
I think that qmail-dkim is not "reading" the selector file to make de DKIM signature
"s=" is allways "default"
Reply | Permalink
Problem using a selector different than default
ChangHo.Na Pablo Murillo April 21, 2019 07:43
Hi,
file: /var/qmail/bin/dk-filter
modify #90 line:
and rebulid domainkeys
Reply | Permalink
Problem using a selector different than default
ChangHo.Na ChangHo.Na April 21, 2019 11:27
Sorry!
file: /var/qmail/bin/dk-filter
modify #124 line:
You don't need to rebuild domainkeys.
Reply | Permalink
Problem using a selector different than default
Pablo Murillo Roberto Puzzanghera February 14, 2019 16:00
The result for gmail es a failure too
I created a new domainkey with "default" as selector, and everything works good
I wil made more test with more domains to see if the problem persist
Reply | Permalink
Problem using a selector different than default
Anonymous Pablo Murillo February 15, 2019 06:52
So you want your selector to be MYdkim
This is what you should do. Remember that the selector is always taken from the basename of the file that the environment variable DKIMKEY is set to.
If the last component of the path is 'default', the selector will be default. If the last component is MYdkim, the selector will by MYdkim.
So your private key should be named MYdkim. i.e.
/web/conf/domainkeys/pablomurillo.com.ar/MYdkim
The file MYdkim can be a symbolic link too to the filename of your choice.
and your public key could be named anything as it is not used internally by qmail-dkim
Reply | Permalink
Problem using a selector different than default
Pablo Murillo Anonymous February 15, 2019 23:12
Hi
I'm doing that
After read a little I discovered the "problem"
Is not the best way if you need to use more than one "selectors"
The right solution is read the selector file , but my C is not as good as I like to do this
Reply | Permalink
Problem using a selector different than default
Roberto Puzzanghera Pablo Murillo February 14, 2019 17:11
Ok, let me know. I'll do some tests when I find some time and eventually inform M.Bhangui
Reply | Permalink
Problem using a selector different than default
Pablo Murillo Roberto Puzzanghera February 14, 2019 20:36
Finally !, I found the solution
I think, is not the best , but ...
The selector is taken from "DKIMKEY" , so I changed DKIMKEY in qmail-smptd/run to :
DKIMKEY=/web/conf/domainkeys/%/RNAdkim
Also, I changed the "ln -s" of "rsa.public_RNAdkim" from "default" to "RNAdkim"
Is a solution, not the right one for me, because if you plan to use different selectors, this will be a problem
I think that the right behavoir will be read the "selector" file, not use the "name" of the "symbolic link"
Reply | Permalink
Problem using a selector different than default
Roberto Puzzanghera Pablo Murillo February 14, 2019 20:44
Great.
Anyway, as you may have noticed, Manvendra Bhangui will take a look at this in the w/e https://notes.sagredo.eu/en/qmail-notes-185/configuring-dkim-for-qmail-92.html#comment1230
Reply | Permalink
Problem using a selector different than default
Pablo Murillo Roberto Puzzanghera February 15, 2019 04:26
Yes, yes
Thanks
Reply | Permalink
usage 2038 keys
qmailing August 30, 2018 15:38
can you change script domainkey to usage 2048 keys ?
Reply | Permalink
usage 2038 keys
ChangHo.Na qmailing April 21, 2019 08:05
Hi,
1. modify domainkey file:
to
2. modify dk-filter file:
to
or use DKIMSIGNOPTIONS option
3. rebuild domainkeys
4. settings dns
Reply | Permalink
usage 2038 keys
Roberto Puzzanghera ChangHo.Na April 22, 2019 19:44
thank you
to have such a long dns record under bind I had to split the domainkey as follows
so that each line doesn't exceed 256 chars lenght
I tested this sending a test mail to check-auth@verifier.port25.com and the verification was good. Unfortunaly a test against gmail failed (verification failure) so I'm sticking with 1024 keys.
Any hint would be appreciated
Reply | Permalink
usage 2038 keys
ChangHo.Na Roberto Puzzanghera April 25, 2019 06:32
Hi,
Gmail is no problem!
My dns:
Reply | Permalink
usage 2038 keys
ChangHo.Na Roberto Puzzanghera April 25, 2019 06:24
Hi,
How to Split DNS DKIM Records Properly.
http://hack.limbicmedia.ca/how-to-split-dns-dkim-records-properly/
Reply | Permalink
usage 2038 keys
Roberto Puzzanghera ChangHo.Na April 25, 2019 17:32
I've followed this howto concerning the long dns splitting and I'm still unable to pass the gmail dkim test.
In addition, sending a test mail to check-auth@verifier.port25.com results in a wrong dns record interpretation (note the default._domainkey.mydomain.tld. IN TXT inside):
while my dkim record(s) is
Note that check-auth@verifier.port25.com was not complaining when setting my dns like this
On the contrary mxtoolbox.com tests are ok
Reply | Permalink
usage 2038 keys
ChangHo.Na Roberto Puzzanghera April 26, 2019 20:02
Hi,
My case:
send mail to gmail: fail
after 10minutes: fail
after 30minutes: pass
after 1hour: pass
after 1day: pass
I think, you're dns is correct.
Reply | Permalink
usage 2038 keys
Roberto Puzzanghera ChangHo.Na April 27, 2019 12:40
Great, gmail verification passed!
My dns is like this:
I'm signing at qmail-remote level adding DKIMSIGNOPTIONS="-z 2" in my /var/qmail/rc
Reply | Permalink
usage 2038 keys
Roberto Puzzanghera Roberto Puzzanghera April 27, 2019 12:43
At this point having a modified domainkey script file, which outputs a splitted dns record in case of 2048 key, from someone who have shell skills better than mine would be very much appreciated... :-)
Reply | Permalink
usage 2038 keys
Roberto Puzzanghera qmailing August 31, 2018 21:55
upgraded. thanks
Reply | Permalink
usage 2048 keys
Roberto Puzzanghera Roberto Puzzanghera September 22, 2018 11:20
I restored the 1024 key, because my bind server was failing to load zones with such a long line. Any comment would be appreciated
Reply | Permalink
usage 2048 keys
Me Roberto Puzzanghera October 12, 2018 11:17
you must separate long key with more than 255 charset " (quotation marks)
Reply | Permalink
usage 2048 keys
Tatsuya Yokota Me December 7, 2019 05:33
github
https://github.com/kotaroman/domainkey
thank you.
Reply | Permalink
usage 2048 keys
Tatsuya Yokota Me December 7, 2019 05:28
I tried to support the domainkey command for 2048bit.
TXT record for BIND is automatically set to 2 lines.
modified
https://acoustype.com/domainkey
original
https://notes.sagredo.eu/files/qmail/domainkey
thank you.
Reply | Permalink
usage 2048 keys
Roberto Puzzanghera Tatsuya Yokota December 8, 2019 14:06
I published your modified script. Thanks again
Reply | Permalink
usage 2048 keys
Roberto Puzzanghera Tatsuya Yokota December 7, 2019 07:54
Great contribution, very much appreciated. I'm going to make tests as soon as possible
Reply | Permalink
Improvement
Mirko Buffoni August 17, 2018 14:13
Thank you Roberto for such a good and clear guide to DKIM and qmail.
I've made a little improvement that I want to share. I've made it to solve my need to sign messages sent by authenticated users, and to verify all non authenticated ones.
With the current code, it is not possible to achieve this. However with a little modification, it can be done pretty easily. I changed the behavior of RELAYCLIENT_NODKIMVERIFY (which IMHO is wrong at the moment, since it will skip verification, but also any eventual signing that may have been requested).
I've added a check for env variable RELAYCLIENT_NODKIM, which if present, will skip verification and signing step, going on directly with the next QUEUE command (like the current behavior).
Instead, if RELAYCLIENT_NODKIMVERIFY is present, it will void any DKIMVERIFY, and will go on with the code, allowing to sign a message if DKIMKEY is specified or a default domainkey is available for that domain (!DKIMSIGN && !DKIMVERIFY && RELAYCLIENT).
Pheww, too much words. The patch is simpler and easier to read, though ;)
/etc/tcprules.d/tcp.smtp:
Patch:
Ciao!
Reply | Permalink
Improvement
Roberto Puzzanghera Mirko Buffoni August 17, 2018 14:33
Actually the logic behind the RELAYCLIENT_NODKIMVERIFY variable is to avoid that the outgoing messages will be verified as well
Reply | Permalink
Improvement
Anonymous Roberto Puzzanghera August 17, 2018 14:57
Ok, but the name _NODKIMVERIFY misleaded me to think that only the verification step was skipped.
Reply | Permalink
Improvement
Roberto Puzzanghera Anonymous August 17, 2018 15:02
This is what actually does... that variable is there to avoid that outgoing msg could be verified before getting the queue and be signed via qmail-remote
Reply | Permalink
Improvement
Roberto Puzzanghera Mirko Buffoni August 17, 2018 14:23
Great! Thank you
Reply | Permalink
mails do not have a signature via php
Chava2b September 20, 2017 18:00
Hi,
I have in the file /var/qmail/supervise/qmail-smtpd/run
The dkim signature is present if I use outlook for example (relay) but is not present if I send a mail by a php script from the mail server.
Have I forgotten anything? Thank you for your help
regards
Reply | Permalink
Re: mails do not have a signature via php
Roberto Puzzanghera Chava2b September 20, 2017 21:49
I have never tested this, as I usually run php in a server that is separated from qmail. As you know, the php mailer calls the sendmail program, which is an alias of /var/qmail/bin/sendmail. Perhaps the qmail's sendmail program injects the message directly via qmail-inject without opening a connection to qmail-smtpd on port 25 and without the call of any filter like qmail-dkim, but I admit that I didn't look at the code, so any other explaination would be welcome
Reply | Permalink
How can I use this patch only and not all the package ?
Pablo Murillo March 2, 2017 00:34
Hi
I'm FreeBSD user, and I don't use netqmail, Is there a way to only implement DKIM patch and not all the others ?
Reply | Permalink
Sorry Pablo, I can't get what
roberto puzzanghera Pablo Murillo March 7, 2017 22:36
Sorry Pablo, I can't get what you mean.. you say that you don't use netqmail but that is a patch for netqmail...
Reply | Permalink
How to sign with algorithm rsa-sha256
Daniel Prosser August 23, 2016 03:19
I hope this isn't a stupid question. I've got qmail signing outgoing email, but they're all using rsa-sha1. How can get it to use rsa-sha256?
Reply | Permalink
As I suspected, it was a
Daniel Prosser Daniel Prosser August 23, 2016 19:09
As I suspected, it was a stupid question. I checked out my version of openssl and it didn't have sha256 available. The man page for openssl dgst recommended using SHA1, it was so old. I'm currently building a newer version from source.
Reply | Permalink
Fails to verify if subject not in h= list
C Pitchford February 16, 2016 14:16
I've noticed that Sky UK is sending out legitimate emails including a dkim signature that does NOT include the subject:
I don't think excluding the subject from the signature is against the spec, even if it is silly. It does, however, fail verification
I've added this option to qmail-dkim.c to relax this restriction:
This value ensures it will permit a signature that does not include the subject
It may be worth making this configurable (with an environment variable or a switch to DKIMVERIFY?)
Reply | Permalink
Re: Fails to verify if subject not in h= list
Manvendra C Pitchford February 17, 2016 05:47
Thank you. It is a simple fix. Will have the environment variable UNSIGNED_SUBJECt and let Robert know the url for the latest patch
Reply | Permalink
Re: Fails to verify if subject not in h= list
Manvendra Manvendra March 7, 2016 07:59
Two New patch uploaded to https://sourceforge.net/projects/indimail/files/netqmail-addons/qmail-dkim-1.0/
One which includes spf + ipv6 + dkim
and one which has only dkim
Reply | Permalink
Re: Fails to verify if subject not in h= list
roberto puzzanghera Manvendra March 10, 2016 12:37
Thank you Manvendra. I have updated my combined patch accordingly
Reply | Permalink
I will ask Manvendra Bhangui
roberto puzzanghera C Pitchford February 16, 2016 22:11
I will ask Manvendra Bhangui to look at your comment. Thank you
Reply | Permalink
qmail-dkim: signature error: RSA verify failed but testing
Marcello Lupo roberto puzzanghera March 24, 2017 18:02
Hi,
even if I installed the latest patch on my system I'm not able to receive password reset email from GitHub.
I created another account on GitHub using a Gmail account and on that account I receive the email correctly.
Can you help me to understand why on my server it is failing?
These are the DKIM headers i receive on Gmail account for the pasword reset email:
Thank you
Regards
Marcello
Reply | Permalink
Re: qmail-dkim: signature error: RSA verify failed but testing
Manvendra Marcello Lupo March 25, 2017 04:30
What is the value of your DKIMVERIFY envrionment variable?
In DKIMVERIFY have the letter 'j' included in lower case. Once you have the email in your system, you can test it by supplying the raw text on stdin to dkimtest.
Reply | Permalink
No Output and Exit status 53
Marcello Lupo Manvendra March 27, 2017 16:22
Hi Manvendra,
if I disable the DKIM on the system the email is received perfectly.
If i pass the raw email to DKIM on the shell i get no output and the exit code is 53 .
If i make the same with a normal gmail email recevide from the server i get the the complete Email on the output with the DKIM-Status: good Header.
Have you any suggestion?
Thank you
Bye
Marcello
Reply | Permalink
DKIM Failing [SOLVED]
Marcello Lupo Marcello Lupo March 27, 2017 17:46
Hi,
I found the problem. It was a Baesyan filter on a FortiMail system in front of my server that was recognizing that email as SPAM and was altering the Subject. When the email reach my server with the Subject altered it fail the DKIM Check. Now without the Subject altered it works perfectly.
Thank you for your availability and sorry if i make you loose some time.
Bye
Marcello
Reply | Permalink
This example implies qmail-dkim man page to be corrected.
Manvendra Marcello Lupo March 27, 2017 19:00
Problem: Marcelo was receiving an email where the content of the email was changed (in particular the Subject header).
This caused qmail-dkim to issue the following error
The man page states that DKIMVERIFY should have the letter j for returning temporary error and the letter J for issuing permanent error.
It does not mention that if you omit the letter 'j' or the letter 'J', the email will successfully pass through the queue and get delivered.
So should I modify the qmail-dkim patch for this change in the man page. Most of the dkim verification error results because the message gets modified by some filter before qmail-dkim and you could potentially lose email, like Marcelo.
The troubleshooting test that Marcelo was doing also failed because DKIMVERIFY had the small letter 'j'. If he omits the leter 'j', he should get the output along with the DKIM-Status header. My view is that if you do not want to lose emails and you do not have the habit of looking at the logs for temporary errors, the letters 'j' or 'J' should be completely omitted from DKIMVERIFY
Reply | Permalink
glad to know that your problem got fixed
Manvendra Marcello Lupo March 27, 2017 18:17
That's good news.
However I was surrprised when you were getting error code 53. Maybe you were piping the output to less or more.
if you use the following script as cat instead of /bin/cat then the troubleshooting always works
Reply | Permalink
exit code 53 means that qmail
Manvendra Marcello Lupo March 27, 2017 17:36
exit code 53 means that qmail-dkim was not able to write to either stdout or stderr. The function die_write() exits with 53. Is it possible to attach the raw email and send it to my private email address? I shoudl be able to debug. I hope there is nothing sensitive in the email.
Reply | Permalink
it seems like you don't have
roberto puzzanghera Marcello Lupo March 24, 2017 20:42
it seems like you don't have the DKIM correctly configured. Did you perform all the tests suggested in this page? Which one eventually failed?
Please post your run file
Reply | Permalink
I had the DKIM working for
Marcello Lupo roberto puzzanghera March 24, 2017 23:43
I had the DKIM working for years and due to this error i was getting i made the update to your latest patch on today but the problem still persist.
I'm able to receive mail from gmail and other DKIM enabled servers but not this one. I was thinking the it can be related to the UNSIGNED_SUBJECT but i seems not to be this the issue.
Here my run file:
Thank you
Bye
Reply | Permalink
You have the letter 'j' in
Manvendra Marcello Lupo March 25, 2017 10:52
You have the letter 'j' in DKIMVERIFY. So qmail-dkim will not exit with 100. Have QMAILQUEUE changed temporarily to bypass qmail-dkim and check. If you still do not receive email then it could be something else. If you receive the qmail
After making the above change, save the incoming email to /tmp/mail.txt and you can do the following to troubleshoot
Reply | Permalink
I've been running with the
C Pitchford roberto puzzanghera February 17, 2016 01:19
I've been running with the patch for a few days. Here are some of the domains that seem to be sending these problem signature:
These emails are now being accepted and validated. It looks like a fairly new trend to exclude the subject from the list of headers. I guess paypal is probably the most serious on the list
Reply | Permalink
DKIM DNS Long records Issue
Marcello Lupo November 5, 2015 14:41
Hi,
I found that apple.com, for example, use DNS long records that are splitted in TXT chunks. You can try it doing "dig -t txt mailout2048s._domainkey.apple.com" . My qmail-dkim is failing to check this DKIM signature (google.com is working instead).
Is it possible that qmail-dkim module have problems dealing with this kind of DNS records?
I hope Manvendra Bhangui or someone else can address on this issue.
Thank you
Regards,
Marcello
Reply | Permalink
DKIM DNS Long record issue
Manvendra Marcello Lupo December 13, 2015 04:58
qmail-dkim does not have an issue with assembling long text records. e.g.
The same result from indimail's dnstxt program (qmail-dkim uses the same function)
Also all emails from apple.com seems to be getting verified. You can send me a raw text of any one email that is not getting verified so that I can investigate.
Reply | Permalink
Raw text
Marcello Lupo Manvendra December 13, 2015 13:53
Hi Manvendra,
yes I can send raw text email to you but prefer to do it in a PM.
Can you send me you email or let Roberto to give it to me?
Thank you,
Regards,
Bye
Marcello
Reply | Permalink
DKIM Signature problem with emails received from apple.com
Manvendra Marcello Lupo December 15, 2015 05:42
I have debugged the issue with help of the raw email. There were two issues. The first issue is verifiying if the signature has expired. This is done by using t= and x= tags. Unfortunately, one of the funtions is using an integer variable to compare the timestamps and due to this, the signature is shown as expired. This issue was easy to fix and I have made the changes
The second problem is X-Brightmail-Tracker header inserted below the DKIM-Signature. This causes the signature not to verify. After removing the X-Brightmail-Tracker, I am able to verify the signature as good. This issue can be solved by ignoring headers not present in the h= tag. However, since this part of the code is from ALT-N technologies, I might take some time to add some code to skip such headers. I will get back as soon as possible with a fix. If I cannot find a way to fix this, I can always put a wrapper before calling qmail-dkim to skip headers not present in the h= tag.
Reply | Permalink
Re: DKIM DNS Long records Issue
Manvendra Bhangui Marcello Lupo November 6, 2015 02:01
Thanks for pointing this out. WIll investigate this during the weekend and come up with a fix in case there is a bug.
Reply | Permalink
qmail-dkim: signature error: permanent dns failure
nic September 8, 2015 12:19
Dear Roberto,
I had just recieved an error "qmail-dkim: signature error: permanent dns failure requesting selector (#5.7.0)" from a remote domain. That domain does not publish any domainkey. My configure is like so
Any idea where i should start to look?
Thanks
nic
Reply | Permalink
the answer is in the qmail-dkim man page
roberto puzzanghera nic September 30, 2015 19:30
Nic, the answer is in the qmail-dkim man page.. you have to relax the filter if you don't want to reject those kind of msg. The Q letter should be lowercase, but I'm not sure that doing so is a good idea..
Reply | Permalink
wrong password logs
nic June 24, 2015 18:14
Hi Roberto,
I remembered when i was still using Bill's toaster, i have a log of wrong password logins. Is this log available in your version?
It was in /var/log/maillog in Bill's version.
Thanks
nic
Reply | Permalink
yes it is /var/log/maillog
roberto puzzanghera nic June 24, 2015 18:58
yes it is /var/log/maillog
Reply | Permalink
Many thanks =)
nic roberto puzzanghera June 24, 2015 22:29
Many thanks =)
Reply | Permalink
Authentication-Results
Behnam December 26, 2014 11:40
Hi
I have some questions
Do you know any solution or patch to add Authentication-Results header for dkim and spf to your combind patch?
how can I sign and verify my local mails?
when I set QMAILLOCAL and set the proper permission to private key and public key, I can sucssesfuly sign local mails but I can not verify that mails and it has DKIM-Status: no signatures ( I comment "export RELAYCLIENT_NODKIMVERIFY=1" to verify local mails ).
Thanks
Behnam
Reply | Permalink
I don't know of any patch to
roberto puzzanghera Behnam December 26, 2014 12:02
I don't know of any patch to write dkim and/or spf results into that field, but you can see their response in "DKIM-status" and "Received-SPF" respectively.
Reply | Permalink
dkim for local mails not work
Behnam December 25, 2014 20:52
even with set QMAILLOCAL to /var/qmail/bin/spawn-filter in /var/qmail/rc , I can not sign local mails.
and if I set QMAILQUEUE=/var/qmail/bin/qmail-dkim I received "qq temporary problem (#4.3.0)" when sending local mails.
/var/qmail/rc :
qmail-smtpd/run
/var/qmail/control/defaultdelivery
Reply | Permalink
I don't know... your config
roberto puzzanghera Behnam December 26, 2014 11:52
It's strange... your config seems to be correct, but there's no need of declaring QMAILLOCAL to have local mails signed.
Have you done the tests suggested toward the bottom of this page? If yes you should try to debug with strace
Reply | Permalink
now sign but not verify
Behnam roberto puzzanghera December 26, 2014 13:09
Thanks for your reply :-)
I found the problem was permission of private key that root user ( owner of qmail-lspawn ) can not read that file.
now my local mails is somethins like this :
( when DKIMVERIFY="FGHKLMNOQRTVWjpu" is set )
( when DKIMVERIFY="FGHKLMNOQRTVWjpu" is not set )
and I hadn't any DKIM-Status in the second mail
Reply | Permalink
can you post your smtpd
roberto puzzanghera Behnam December 26, 2014 15:49
can you post your smtpd run file, or at least confirm that DKIMVERIFY and DKIMSIGN are NOT both defined there?
Reply | Permalink
sorry, I see know that the
roberto puzzanghera roberto puzzanghera December 27, 2014 10:02
sorry, I see now that the verification is done, but for an unknown reason the sign is not matched into the message...
The DKIM verification inside the X-Spam-Status field has nothing to do with the qmail patch, as it's written by spamassassin. So you have to declare DKIMVERIFY
Reply | Permalink
Question about run scripts config with simscan
Marc August 21, 2014 17:48
Hello,
after using your guide to install simscan i am a little bit confused about the config of the qmail-smtpd/run and qmail-submission/run scripts. Before Simscan installation you wrote in the DKIM tutorial:
Insert the two following environment variables in your /var/qmail/supervise/qmail-smtpd/run script:
In the description Making qmail-dkim and simscan live together you wrote:
You have to modify like this your /var/qmail/supervise/qmail-smtpd/run script (and /var/qmail/supervise/qmail-submission/run as well)
The question is, why i have to add in the simscan configuration the parameter export DKIMKEY=/usr/local/etc/domainkeys/%/default. I thougt this was covered with the /var/qmail/rc script. Maybe i miss something in my understanding of the how the things work together.
And another question: The export parameters in the qmail-submission/run script should match with all the Export settings in the qmail-submission/run script?
Thanks for helping.
cheers
Reply | Permalink
Hi Marc, thanks for your
roberto puzzanghera Marc August 22, 2014 10:23
Hi Marc, thanks for your contribution.
You can do in both ways. That was the old method, when the signing had to be done at qmail-smtpd level with all the variables declared in the qmail-smtpd run file. But now I'm signing at qmail-remote level, so the variables have to be declared in the rc file.
I'm going to correct this. Thank you
Reply | Permalink
Contents of DKIMSIGN environment variable
Otto Dandenell August 21, 2014 02:04
Hi Roberto,
You should probably make all examples consistent with the default key locations.
In your /var/qmail/rc example script, you have:
But this should instead be:
Same with the Signing test example.
Or as an alternative, point out to the reader that the keys are generated in one path but the script examples assume they have been copied to another path.
I think this is probably what went wrong for the reader who couldn't get his signing to work.
Regards
/ Otto
Reply | Permalink
thanks
roberto puzzanghera Otto Dandenell August 21, 2014 12:57
Hi Otto, thanks for your contribution.
Corrected. Of course it was a not wanted error and there will surely be other :)
Reply | Permalink
White List form DKIM
Arturo June 5, 2014 18:12
Hi,
I have the following error and would need to receive these e mails.
Is there any way to include a whitelist domains?
Thanksss :)
Reply | Permalink
unfortunately there's no
roberto puzzanghera Arturo June 5, 2014 22:07
unfortunately there's no whitelist functionality in the dkim program. The error suggests a permanent dns error
Reply | Permalink
invalid structure
ss January 22, 2014 08:56
found the solution to the problem, was an issue with the ticketing system
please discard previous comment
thanks
Reply | Permalink
Invalid structure
ss January 22, 2014 08:14
Hello,
First let me thank you for the excellent write up on the qmail installation guide.
I am having a problem where sending mail to only certain users on my mail server are being rejected with the following error:
The mails are being sent from a ticketing system and the problem started to occur recently.
Regards,
ss
Reply | Permalink
qmail-dkim error
Nicholas October 19, 2013 10:01
Hi Roberto,
I am getting alot of the errors below. Seems like the receiving mail server cannot verify the DKIM of the incoming email. Is it right to say that? What can i do to allow this coming email?
message delayed (qmail-dkim: DKIMContext structure invalid for this operation (#4.3.0)): investigations@FBI.GOV from 194.50.9.6
Thanks
nic
Reply | Permalink
what do you have in your
roberto puzzanghera Nicholas October 19, 2013 13:13
what do you have in your DKIMVERIFY?
Reply | Permalink
export DKIMVERIFY="DEGIJKfh"
Nicholas roberto puzzanghera October 19, 2013 13:37
export DKIMVERIFY="DEGIJKfh"
Reply | Permalink
I don't know exactly what is
roberto puzzanghera Nicholas October 19, 2013 14:43
I don't know exactly what is causing the error and I'm not sure that it's a regular rejection.
To make tests we need a raw message like that, but in this case you should temporarily disable the verification. Send me it in private if you like
Reply | Permalink
DKIM not sign
Nicholas July 1, 2013 13:09
I had tried to use verifier-feedback@port25.com to check, it came with a neutral result.
In my named.conf i had also added the TXT record
My run file i have
In /var/qmail/control/domainkeys/domain.com folder i have
Am I missing out anything?
Thanks
Nic
Reply | Permalink
RE: DKIM do not sign
roberto puzzanghera Nicholas July 1, 2013 13:27
Nick, the config seems ok. Did you remember to set the variable RELAYCLIENT in your tcp.smtp?
Reply | Permalink
Thanks for your reply
Nicholas roberto puzzanghera July 3, 2013 09:47
Thanks for your reply.
I have
regards
nic
Reply | Permalink
Apparently your config is
roberto puzzanghera Nicholas July 3, 2013 10:01
Apparently your config is ok.. are you sure that your loopback IP is working? Try to assing RELAYCLIENT to your LAN and to your public IP as well.
In addition, but that's not so important, you have already exported QMAILQUEUE in your run file, so declaring it in the last line is redundant.
Reply | Permalink
Many thanks again.This box
Nicholas roberto puzzanghera July 3, 2013 12:16
Many thanks again.
This box has only a public IP.
Do i replace 127 with my public IP to do testing?
127.:allow,RELAYCLIENT=""
I had also removed QMAILQUEUE
Reply | Permalink
No, just add one more line
roberto puzzanghera Nicholas July 3, 2013 12:20
No, just to add add one more line like this:
This will work in case your loopback is not working (just a guess)
Reply | Permalink
Thanks roberto.I had done
Nicholas roberto puzzanghera July 3, 2013 13:12
Thanks roberto.
I had done what you had sugguested. But it is still not working
Thanks
nic
Reply | Permalink
What the tests from the
roberto puzzanghera Nicholas July 3, 2013 14:11
What the tests from the command line say? Did you check the priviledges of the domain key? I everything is ok I would try to debug with strace. That will show everything
Reply | Permalink
Hi,The tests are identical to
Nicholas roberto puzzanghera July 3, 2013 17:21
Hi,
The tests are identical to your tutorial.
How do i use strace to debug?
Thanks
nic
Reply | Permalink
Tests from the command line
roberto puzzanghera Nicholas July 3, 2013 22:10
Tests from the command line are ok. It must be a tcp.smtp/QMAILQUEUE issue..
You can save the strace log in this way:
But do not post the log as a comment, because it will be very long. Feel free to contact me in private instead
Reply | Permalink
Thanks.Am i right to strace
Nicholas roberto puzzanghera July 3, 2013 22:39
Thanks.
Am i right to strace /usr/local/bin/tcpserver -v -H -R -l 0 -x /home/vpopmail/etc/tcp.smtp.cdb ?
regards
nic
Reply | Permalink
No, simply the process id of
roberto puzzanghera Nicholas July 3, 2013 22:51
No, simply the process id of qmai-smtpd
Reply | Permalink
HiI had strace pid 994 which
Nicholas roberto puzzanghera July 3, 2013 23:08
Hi
I had strace pid 994 which is running the process "supervise qmail-smtpd"
I tried sending out an email to gmail. Received the email but nothing is logged.
994 restart_syscall(<... resuming interrupted call ...> <unfinished ...>
Many thanks again
nic
Reply | Permalink
Actually you have to strace
roberto puzzanghera Nicholas July 3, 2013 23:14
Actually you have to strace the tcpserver process_id which belongs to qmail-smtpd..
Reply | Permalink
Ok.Nothing is logged
Nicholas roberto puzzanghera July 4, 2013 00:35
Ok.
Nothing is logged. Send out a few mails to gmail account and the log shows
27792 accept(3,
regards
nic
Reply | Permalink
Try this way
roberto puzzanghera Nicholas July 4, 2013 09:39
Also remember that you have to wait for the greetdelay, so don't stop strace immediately..
Reply | Permalink
Nothing at all.. Weird.
Nicholas roberto puzzanghera July 4, 2013 10:10
Nothing at all.. Weird. Outgoing is not stracable? But incoming does. I had send out 5 test mails to gmail and make sure they are delivered before stopping the strace.
The log reads 19151 accept(3,
regards
Reply | Permalink
you have a 300s timeout in
roberto puzzanghera Nicholas July 4, 2013 10:18
you have a 300s timeout in the rblsmtpd..
Reply | Permalink
Ok.I remove all other
Nicholas roberto puzzanghera July 4, 2013 10:33
Ok.
I remove all other additional.
This time round, i sent out 5 test mails each to yahoo and gmail and made sure all 10 mails are received before checking the log
If outgoing is not logging, will incoming log helps in my case?
regards
nic
Reply | Permalink
and how you are using strace?
roberto puzzanghera Nicholas July 4, 2013 10:38
and how you are using strace? I mean which process id?
PS Nic, can we continue this conversation as a private msg? This thread is going to be so long...
Reply | Permalink
qmail-dkim not sign the mail
Jacekalex October 2, 2011 19:57
Hi
I have a problem with qmail-dkim.
The program mails from RELAYCLIENT signs, but not signed messages sent from other hosts that are not in RELAYCLIENT, and were sent using SMTP-AUTH.
I found the solution to the problem at:
http://qmail.jms1.net/patches/combined-details.shtml
Specifically:
"An example of a patch which needs this functionality, and in fact the initial reason for writing this patch, is the domainkeys patch. In order to verify a signature for an incoming message, it requires that a variable DKVERIFY exist, which contains a list of letters telling which domainkeys results should be considered hard or soft errors. However, in order to sign outgoing messages, it requires that DKVERIFY should NOT exist.
This patch allows me to create an AUTH_SET_DKSIGN environment variable, and when the user AUTH's, it adds a DKSIGN variable to the environment, which forces the qmail-dk program to sign the message instead of verifying it. Without this, the only way to make domainkeys work was to enable it for certain IP addresses in the /etc/tcp/smtp.cdb file, which was no good for clients who used AUTH in order to relay."
Can I count on the fact that a similar mechanism appears in Your patch?
Cheers
:)
Reply | Permalink
qmail-dkim not sign the mail
Cprogrammer Jacekalex August 15, 2013 15:06
Jacekalex ,
you could do the following. Write a dkim shell wrapper as below
and have the above shell script defined in QMAILQUEUE instead of qmail-dkim
Reply | Permalink
Re: qmail-dkim
roberto puzzanghera Jacekalex October 2, 2011 20:27
Hi Jacekalex,
qmail-dkim will sign your messages if the variable RELAYCLIENT is set and will verify all messages from IPs where RELAYCLIENT is not set (but only if you set DKVERIFY). So this is exactly how it should work.
The mechanism of the patch included in the John Simpson's combined patch is different from the one of the DKIM patch authored by Manvendra Bangui and embedded in my big one, as the signing is not triggered by the authentication here.
For any further info and/or troubleshooting do not hesitate to contact me in private, in you like.
Cheers
Edit:
I assume, if you are using my patch, that you have
in your supervise/qmail-submission/run script as well
Concerning the signing after the smtp-auth, it's not clear to me what you mean by "sent by hosts that are not in RELAYCLIENT". Infact, once authenticated, the sender has the IP of the server, so if 127.0.0.1 has RELAYCLIENT it is going to sign the email..
Reply | Permalink
Hi I have a different,
Jacekalex roberto puzzanghera October 3, 2011 20:28
Hi
I have a different, simpler idea.
Why qmail-dkim should check and parse RELAYCLIENT 5 or ~ 20 different IP addresses, since exactly the same thing does qmail-smtpd?
I have 2 questions:
I'm not a C programmer, all my experience, this short script in the shell or perl.
Where - where in the qmail-smtpd.c, and in what form (int, void, other), add a piece of code:
Why this code?
Depending on the AUTH || RELAYCLIENT, SIGNMAIL variable will have value 1 or 0
Then in the qmail-dkim going to remove a function
and give their own in the shape similar to:
A precisely if $SIGNMAIL = 1 then dkimsign else dkimverify.
In my opinion a much simpler solution, and certainly feasible.
Any suggestions very welcome.
Cheers ;)
Reply | Permalink
Hey Jacekalex, I double
roberto puzzanghera Jacekalex October 4, 2011 18:03
Hey Jacekalex, I double checked my configuration and inside my tcp.submission I simply have:
and my outgoing emails from submission port 587 are signed. No need to put RELAYCLIENT if the client is authenticated.
I don't have the time to study qmail-dkim.c to see where it happens, but the program proves to act as you like.. :-)
Reply | Permalink
Thanks For me I do not want
Jacekalex roberto puzzanghera October 4, 2011 18:21
Thanks
For me I do not want at this moment to sign mail with the authorization of the hosts! RELAYCLIENT, try again to compile the entire qmail, if this does not help, then he'll write a function to the Qmail-scanner, which will sign a check and mails, if need be, then I'll be able to sign up to create a rule in the sql;)
I'm not a C programmer, but in Perl I can cope quite well, and such a function to check or signing with the use of / var / qmail / bin / dkimtest - these are just a few (maybe several) lines of fairly simple code in qmail-scanner, and a little in qmail . c (qq error status).
Cheers
;)
Reply | Permalink
Why qmail-dkim should check
roberto puzzanghera Jacekalex October 4, 2011 00:29
thanks for the contribution, Jacekalex. Unfortunately I've never inspected the code of the DKIM patch. You may want to refer to the author
Concerning the first part of your question, you can include just the 127.0.0.1 which counts for all the IPs which do the smtp-auth and use subnets..
cheers
Reply | Permalink
Let me know what change I should make
Cprogrammer roberto puzzanghera July 8, 2013 06:04
Just stumbled upon this post. The thread is long and I will read all the posts when I get time.
Reply | Permalink