Adding a DKIM record is more complicated than adding a SPF record because it needs to create a public/private key pairs and it also needs to install a DKIM software and configure your mail server to cooperate with the DKIM software to sign your emails. The DKIM record is a TXT DNS record whose content is also generated by the DKIM software. So unlike SPF, you need to install/configure the whole set of software before you can add the DKIM record to DNS. We will use Postfix and opendkim as an example to explain how to generate the DKIM record and add it to DNS.
There are tons of posts on the internet about how to install and set up opendkim. None of them tells you how it exactly works but the instructions listed in their posts are basically working. You can refer to this post about the step by step process to set up opendkim.
install opendkim:
|
1 |
yum install opendkim |
generate public/private keys:
|
1 2 3 |
mkdir -p /etc/opendkim/keys/domainhostseotool.com/ cd /etc/opendkim/keys/domainhostseotool.com/ opendkim-genkey -r -d domainhostseotool.com |
Note that, the opendkim-genkey command generates a key for default selector, which equals to :
|
1 |
opendkim-genkey -r -d domainhostseotool.com -s default |
You can, however, change the selector to what you want such as:
|
1 |
opendkim-genkey -r -d domainhostseotool.com -s mail |
The generated default.txt will contain a tag “s=email”. Do not confuse it with the selector. The s tag means the services the selector(default) can be applied to.
change permissions and owners of the directories:
|
1 2 |
chown -R opendkim:opendkim /etc/opendkim chmod go-rw /etc/opendkim/keys |
configure opendkim:
The main configuration file of opendkim is /etc/opendkim.conf. You need to edit it to specify your domain, signing table file, key table file, external ignore list file and internal hosts file. All these files have default version in /etc/opendkim/: KeyTable, SigningTable, TrustedHosts. You need to edit these files to specify your domain and the key file locations.
Here is working /etc/opendkim.conf:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
AutoRestart Yes AutoRestartRate 10/1h LogWhy Yes Syslog Yes SyslogSuccess Yes Mode sv Canonicalization relaxed/simple ExternalIgnoreList refile:/etc/opendkim/TrustedHosts InternalHosts refile:/etc/opendkim/TrustedHosts KeyTable refile:/etc/opendkim/KeyTable SigningTable refile:/etc/opendkim/SigningTable SignatureAlgorithm rsa-sha256 Socket inet:8891@localhost PidFile /var/run/opendkim/opendkim.pid UMask 022 UserID opendkim:opendkim TemporaryDirectory /var/tmp |
Here is the changed part of KeyTable:
|
1 |
default._domainkey.domainhostseotool.com domainhostseotool.com:default:/etc/opendkim/keys/domainhostseotool.com/default.private |
Here is the changed part of SigningTable:
|
1 |
*@domainhostseotool.com default._domainkey.domainhostseotool.com |
Here is the changed part of TrustedHosts
|
1 2 |
mail.domainhostseotool.com domainhostseotool.com |
Configure Postfix:
Append the following lines to /etc/postfix/main.cf
|
1 2 3 4 |
smtpd_milters = inet:127.0.0.1:8891 non_smtpd_milters = $smtpd_milters milter_default_action = accept milter_protocol = 2 |
Restart opendkim and Postfix
|
1 2 |
service opendkim restart service postfix restart |
Add DKIM record to DNS
|
1 2 3 4 |
cat /etc/opendkim/keys/domainhostseotool.com/default.txt default._domainkey IN TXT ( "v=DKIM1; k=rsa; s=email; " "p=MIGffdsSdfdsfdb3DQEBAQUAA4GNdsfDJLGxfddfXIhnjbWdfdsKUlF2jdsfhdsfdhgfR4nhjkJbfdsffasddSG16ppxsFGxiAlZxfdsfdppRsgfC3MgdfikgYdsfdfgdfQNk5EkP1jhhjkIbJSa3wkjhkjhAB" ) ; ----- DKIM key default for domainhostseool.com |
Now absolutely do not copy all the content of default.txt to the TXT record as those posts tell you to do. To create a DKIM record in DNS, go to the control panel of your domain registrar, enter into DNS settings, click “add TXT/SPF record”, fill hostname with default._domainkey, fill TEXT with
|
1 |
v=DKIM1; k=rsa; s=email; p=MIGffdsSdfdsfdb3DQEBAQUAA4GNdsfDJLGxfddfXIhnjbWdfdsKUlF2jdsfhdsfdhgfR4nhjkJbfdsffasddSG16ppxsFGxiAlZxfdsfdppRsgfC3MgdfikgYdsfdfgdfQNk5EkP1jhhjkIbJSa3wkjhkjhAB |
which is copied from default.txt. You can omit the “s=email” tag to indicate the selector of the dkim record can be applied to any service.
Do not include double quotes! Do not include line breaks! When you click the submit button, the web form will add a double quote at the beginning of the text and a double quote at the end of the text automatically. Yes, the default.txt shows the TXT record comprises of two character-strings, while you only added one character-string but that does not matter. The mail server retrieving the DKIM record only cares about the content inside double quotes. If you insert double quotes in the TEXT edit box, these double quotes will be escaped by back-end which results in wrong DKIM record syntax.
Test the dkim record
To verify the dkim record you added to DNS, issue the following command:
opendkim-testkey -d domainhostseotool.com -s default -vvv
“key is ok” in the output indicates you have added the dkim record successfully.
Reference:https://www.linuxbabe.com/mail-server/setting-up-dkim-and-spf
