Dkim

I was having problems delivering mails to hotmail.

I was getting the usual:

Apr 11 06:49:16 www postfix/smtp[25669]: CD80F1328127: to=<[e-mail]>, relay=mx3.hotmail.com[65.54.188.72]:25, delay=30, delays=27/0/2.4/0.36, dsn=2.0.0, status=sent (250  <[e-mail]> Queued mail for delivery)

But my mail was not getting through to hotmail users mail boxes.

hotmail was just ignoring and silently dropping my mails without producing any error or bouncing it.

What I did to solve this problem was intalling DKIM on the mail server

Initially, I followed this document, to get an idea:

http://www.howtoforge.com/postfix-dkim-with-dkim-milter-centos5.1

But it seems this intructions dont exactly work on Centos 5.4.

I'll explain what I dit to get it working con Centos 5.4:

Install dkim-milter

yum install dkim-milter

Generate The Keys

Download this script that you can use to easily generate the keys for signing the mail:

./dkim-genkey.sh -d <domainname>

Replace <domainname> with the domain name you will be signing mail for.
This will create two files default.txt and default.private
In default.txt you will find the line you have to add to your zone file in you DNS - a sample is below:

default._domainkey IN TXT "v=DKIM1; g=*; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDG81CNNVOlWwfhENOZEnJKNlikTB3Dnb5kUC8/zvht/S8SQnx+YgZ/KG7KOus0By8cIDDvwn3ElVRVQ6Jhz/HcvPU5DXCAC5owLBf/gX5tvAnjF1vSL8ZBetxquVHyJQpMFH3VW37m/mxPTGmDL+zJVW+CKpUcI8BJD03iW2l1CwIDAQAB"; ----- DKIM default for hummy.org

_domainkey.hummy.org IN TXT "t=y;o=~"

default.private contains your private key.
Move this file into /etc/mail/dkim-milter and rename it to <domainname>_default.key.pem:

mv default.private /etc/mail/dkim-milter/<domainname>_default.key.pem

Edit the file /etc/sysconfig/dkim-milter and set the variables:

# To sign only, use -bs
# EXTRA_FLAGS=-bs
USER="dkim-milter"
#PORT=local:/var/run/dkim-milter/dkim-milter.sock
#The program is ignoring these settings. It reads the config from /etc/init.d/dkim-milter
PORT="inet:10035@127.0.0.1"
SIGNING_DOMAIN="hummy.org"
SELECTOR_NAME="default"
KEYFILE="/etc/dkim-milter/${SIGNING_DOMAIN}_${SELECTOR_NAME}.key.pem"
SIGNER=yes
VERIFIER=yes
CANON=simple
SIGALG=rsa-sha1
REJECTION="bad=r,dns=t,int=t,no=a,miss=r"
EXTRA_ARGS="-h -l -D"

The previous code is left here because the original document I was following says so, but I'm not sure dkim-milter is using it.

Remove the -h if you don't want to append an extra header to emails displaying your software version.

EXTRA_ARGS="-l -D"

I have also configured similar setting on /etc/mail/dkim-milter/dkim-filter.conf

Domain    hummy.org
KeyFile            /etc/mail/dkim-milter/hummy.org_default.key.pem
Selector        default
Socket    inet:10035@127.0.0.1
SubDomains    Yes
UserID                dkim-milter
X-Header        Yes

Set X-Header to No if you don't want to append an extra header to emails displaying your software version.

Change the init script file /etc/init.d/dkim-milter, so it opens a TCP socket:
This setting only worked for me when I set it on the init script, and not on /etc/sysconfig/dkim-milter or /etc/mail/dkim-milter/dkim-filter.conf

#SOCKET=local:/var/run/${name}/${name}.sock
SOCKET=inet:10035@127.0.0.1

Configure Postfix to use use tcp sockets and not unix sockets as suggested on the original article

At the en of /etc/postfix/main.cf add the following lines;

smtpd_milters = inet:127.0.0.1:10035
non_smtpd_milters = inet:127.0.0.1:10035

Start dkim-milter and restart Postfix:

service dkim-milter restart

service postfix restart

Check the postfix log /var/log/maillog and check it's working fine.

Send an email to gmail and check the headers on "show details".
It should say "Signed by: hummy.org"

The DNS entry:

_domainkey.hummy.org IN TXT "t=y;o=~"

Says that some email from this domain is signed, t=y means, it is on test mode.
I don't see any harm on leaving this setting as test mode.

I also saw some documents saying…
You can remove the t=y once you are VERY VERY sure that your setup works. DO NOT CHANGE IT TO t=n !

Don't forget to enable dkim-milter at boot time:

chkconfig dkim-milter on

Here's another good document:
http://www.tai.ro/2010/04/03/postfix-with-dkim-domainkeys-spf-and-sender-id/