SPF is quite good – DKIM is better, use both to become best and then, enable DMARC ;)

Please read our article regarding SPF enabling, since we require this to be enabled to follow those steps.

This guide is meant for Debian stretch:)

 

Here we go:

Install the tools

apt-get install opendkim opendkim-tools

Set hings up

The  Main magic happens within the config file:

/etc/opendkim.conf

where we added the following lines ( to the bottom )

Socket inet:8892@localhost
KeyTable /etc/opendkim/key.table
SigningTable /etc/opendkim/signing.table
ExternalIgnoreList /etc/opendkim/trusted_hosts.table
InternalHosts /etc/opendkim/trusted_hosts.table
AutoRestart Yes
AutoRestartRate 10/1h
Mode sv
PidFile /var/run/opendkim/opendkim.pid
SignatureAlgorithm rsa-sha256
Canonicalization relaxed/simple
UserID opendkim:opendkim

 

Ok, before we start through, we need to define some trusted hosts.

Edit the file:  /etc/opendkim/trusted_hosts.table and add the following lines (or more, try to match mynetworks from postfix):

#local
127.0.0.1
[::ffff:127.0.0.0]/104
[::1]/128

 

Afterwards we create a dir structure to represent our needs:

mkdir /etc/opendkim/

mkdir /etc/opendkim/domains/

mkdir /etc/opendkim/domains/domain1.de/

mkdir /etc/opendkim/domains/domain2.info/

…

 

Now, let’s create a key for our first domain and transfer ownership to  user & group opendkim ;)

opendkim-genkey --directory=/etc/opendkim/domains/domain1.de/ --bits=2048 --restrict --selector=20180712 --domain=domain1.de
chown opendkim:opendkim /etc/opendkim/domains/domain1.de/20180712.private

 

Ok – Short overview for people that are too lazy to type opendkim-genkey –help

–directory= place to store the generated key

–bits= key strength (length)

—restrict restrict that key only to mailing

–selector= identifier for the key – using an timestamp is recommended

–domain= guess what !

 

Ok, once we’re done we need to tell the daemon to which key is for which domain …

Therefore we need two files defined in our config:

 

Edit /etc/opendkim/key.table, add the following line:

domain1.de-20180712     domain1.de:20180712:/etc/opendkim/domains/domain1.de/20180712.private

column1:  give your key a name

column2:  match the domain, the identifier and the actual key file

 

Edit /etc/opendkim/signing.table, add  the following line:

domain1.de     domain1.de-20180712

you could also do:

*@domain1.de     domain1.de-20180712

this gives you several matching possibilities ever needed :)

 

Ok, we’re quite close now ;)

Enter the following line from the file /etc/opendkim/domains/domain1.de/20180712.txt to your DNS Server

20180712._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; s=email; "
"p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0O2zRjmGdLecFZUm5YN9Er6Fi539XX6/sf9G1gwkeO4vvXZiJW7Rrxw0kejsavAuHAOTxrwGRmzPNGCn7LpdN5sAZKMTrZpr3Y3BIFi14JmkrJigQJ+Oax6i1hxxnPnRNq08p/Ov6bdQUwOxpG/5xkuSUoKoZC8yvQMMrtXEfv9DPdEZB9nCbnaaDc8cCm1gJ/aWVM57MChCDw"
"ALOhlGXNLEx6sqW1DUowrWhvzfzSoEVVEdhx+H5+43sXE8qnEESBpzbGDqZdhEWnt9+ShsPF5gHBc6z3wrJ/4GMrmOn940hxT4aIB6mUNVm1M8prSczY9KKGkaLZzDBzMDorUHjhhH2UtNTnua706npBhhm5xBsG+2CnTOLoGZ3dlfZaEbKTildSo4RQfAW/z1/Eg21lJDgjVjHSCFLlvZ9A4LINe2rjnz36LP9xR1oRB1wrLFJsg9Y0GT"
"8HsauSOXwoAGEOf765HMif+DL7TKAEJHJpdxmo5+B3NslJBMpS61hWACEmz3db7IUtfAl1uczNrX4sRNGU4sRRBNoM1bxwTNA6aonjxTIMGoHFf1YFneoXte1PPxRDEKv0tyVxJegjKuSQ46ZTjSqpzFt16P79WvhA/0ZsrGR8b7wNV5UuH1k0u/S7KTZvFerNXCD6YJghH7MR0pH7I/xFTcof/JPDRPHzcCAwEAAQ==" ) ; ----- DKIM key 20180712 for domain1.de

and verify (after the dns refresh interval) via

dig TXT 20180712._domainkey.domain1.de

The result should be your entry ;)

 

ok – ready to go – GO:

start opendkim

/etc/init.d/opendkim start

and give it a test

opendkim-testkey -d domain1.de -s 20180712 -vvv

return should look like

opendkim-testkey: using default configfile /etc/opendkim.conf
opendkim-testkey: checking key ‘20180712._domainkey.domain1.de’
opendkim-testkey: key not secure
opendkim-testkey: key OK

Do not worry about the “KEY NOT SECURE” message, this is related to DNSSEC (which is a whole other  topic).

 

Connecting the dots

Assuming, everything is up & running, we still need to embed everything into our postfix world.

If you do not have any milters running, just add the following to your /etc/postfix/main.cf.

###  - DKIM
milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:localhost:8892
non_smtpd_milters = inet:localhost:8892

If  there are already milters, just add the dkim as additional one ;)

For testing reasons, you also might want to add ” soft_bounce=yes” to your main.cf

 

Testing

ok – now that we’re done with the setup, its time for testing ;)

Go to https://mxtoolbox.com/ and enter your domain – it will check most of the settings for you

Write an email from your email@domain1.de address to you@gmail.com and see if the mail will arrive there without problems.

Watch your logs !

 

Wait we’re still not done ?

Nope, there’s still one step needed for enabling DMARC.

As mentioned above, SPF is required for setting up functional DMARC.

Good news: DMARD is just one step (DNS TXT record to do) ;)

My recommendation:

Go here: https://mxtoolbox.com/DMARCRecordGenerator.aspx?domain=domain1.de and customize the DMARD record to your needs.

So we would now set a TXT record for domain1.de like this:

_DMARK.domain1.de     IN     TXT     v=DMARC1; p=none; rua=mailto:862a4bf2@mxtoolbox.dmarc-report.com; ruf=mailto:862a4bf2@forensics.dmarc-report.com

of course you can set your own notification addresses ;) (we recommend that)