Server support blog

I wanted to configure DKIM for sendmail on multiple domains for one of the dedicated servers and found out that there are no usable instructions for CentOS and few that are available are inconclusive (I will provide the list of information sources at the end of this post). Here is my tested working setup:

1. You will need to have EPEL repository installed ( I usually install it along with IUS repo right after fresh OS installation)
2. Next step would be to install dkim-milter package
   
   Shell

   yum -y install dkim-milter

   1	yum -y install dkim-milter

3. Configuration for dkim-milter is in /etc/mail/dkim-milter/dkim-milter.conf file. For multiple domains it should look like this:
   /etc/mail/dkim-milter/dkim-milter.conf

   Shell

   AutoRestart yes AutorestartRate 10/1h AlwaysAddARHeader yes Canonicalization simple/simple Mode sv KeyList /etc/mail/dkim-milter/keys/keylist ExternalIgnoreList /etc/mail/dkim-milter/trusted-hosts InternalHosts /etc/mail/dkim-milter/trusted-hosts LogWhy yes Subdomains no Selector default SignatureAlgorithm rsa-sha256 Socket local:/var/run/dkim-milter/dkim-milter.sock Syslog yes SyslogSuccess yes UserID dkim-milter:dkim-milter X-Header yes

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

   AutoRestart             yes AutorestartRate         10/1h AlwaysAddARHeader       yes Canonicalization        simple/simple Mode                    sv KeyList                 /etc/mail/dkim-milter/keys/keylist ExternalIgnoreList      /etc/mail/dkim-milter/trusted-hosts InternalHosts           /etc/mail/dkim-milter/trusted-hosts LogWhy                  yes Subdomains              no Selector                default SignatureAlgorithm      rsa-sha256 Socket                  local:/var/run/dkim-milter/dkim-milter.sock Syslog                  yes SyslogSuccess           yes UserID                  dkim-milter:dkim-milter X-Header                yes

   Note the Selector value – it could be anything as long as it matches your keys and DNS zone record for your domain.

4. There is a tool for key generation installed by dkim-milter package, or you can use online form for the same purpose. I’ve picked up the shell script from the internet and modified it for my liking. Here it is:
   /etc/mail/create-dkim script

   Shell

   #!/bin/bash usage() { echo "Usage:" echo " $0 <domain.com> [selector name]" echo " default selector name = default" exit 1 } if [ $# -eq 0 ]; then usage exit 1 fi KEYDIR=/etc/mail/dkim-milter/keys/$1 sel=${2-default} mkdir -p $KEYDIR [[ $? -ne 0 ]] && exit 127 /usr/sbin/dkim-genkey -D $KEYDIR -r -d $1 mv $KEYDIR/${sel}.private $KEYDIR/$sel chmod 700 $KEYDIR chmod 600 $KEYDIR/${sel}* chown -R dkim-milter:dkim-milter $KEYDIR echo "*@$1:$1:/etc/mail/dkim-milter/keys/$1/$sel" >> /etc/mail/dkim-milter/keys/keylist echo "Add this lines to $1 DNS zone file" cat $KEYDIR/$sel.txt echo '_ssp._domainkey IN TXT "t=y; dkim=unknown"' echo '_adsp._domainkey IN TXT "dkim=unknown"'

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

   #!/bin/bash usage() {   echo "Usage:"   echo "   $0  <domain.com>  [selector name]"   echo "   default selector name = default"   exit 1 }   if [ $# -eq 0 ]; then   usage   exit 1 fi KEYDIR=/etc/mail/dkim-milter/keys/$1 sel=${2-default} mkdir -p $KEYDIR [[ $? -ne 0 ]] && exit 127 /usr/sbin/dkim-genkey -D $KEYDIR -r -d $1 mv $KEYDIR/${sel}.private $KEYDIR/$sel chmod 700 $KEYDIR chmod 600 $KEYDIR/${sel}* chown -R dkim-milter:dkim-milter $KEYDIR echo "*@$1:$1:/etc/mail/dkim-milter/keys/$1/$sel" >> /etc/mail/dkim-milter/keys/keylist echo "Add this lines to $1 DNS zone file" cat $KEYDIR/$sel.txt echo '_ssp._domainkey IN TXT "t=y; dkim=unknown"' echo '_adsp._domainkey IN TXT "dkim=unknown"'

   Save the file as /etc/mail/create-dkim, and do chmod 755 /etc/mail/create-dkim.
   Lets generate keys for yourdomain.com

   Shell

   ./create-dkim yourdomain.com Add this lines to yourdomain.com DNS zone default._domainkey IN TXT "v=DKIM1; g=*; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCt0O6SDq7sh8X4g/mdKhqkXJrIfDmQHcwOq+Rplpls0SL8bFImXTTnwHsyqHOiLI9HAwNNw41gyVrnUnRjG9j7FKU1B9ImIPwgFs40RgcuOBnv96nDi8kdT1Iv/wFkRBYKZjh5TwrHCd4ZTR5Arp9aT3kQeDM7bCzIPK/gasb9rQIDAQAB" ; ----- DKIM default for yourdomain.com _ssp._domainkey IN TXT "t=y; dkim=unknown" _adsp._domainkey IN TXT "dkim=unknown"

   1 2 3 4 5

   ./create-dkim yourdomain.com       Add this lines to yourdomain.com DNS zone default._domainkey IN TXT "v=DKIM1; g=*; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCt0O6SDq7sh8X4g/mdKhqkXJrIfDmQHcwOq+Rplpls0SL8bFImXTTnwHsyqHOiLI9HAwNNw41gyVrnUnRjG9j7FKU1B9ImIPwgFs40RgcuOBnv96nDi8kdT1Iv/wFkRBYKZjh5TwrHCd4ZTR5Arp9aT3kQeDM7bCzIPK/gasb9rQIDAQAB" ; ----- DKIM default for yourdomain.com _ssp._domainkey IN TXT "t=y; dkim=unknown" _adsp._domainkey IN TXT "dkim=unknown"

   You should have keys generated and named according to the script inside /etc/mail/dkim-milter/keys/yourdomain.com and updated /etc/mail/dkim-milter/keys/keylist
   Add these 3 lines to your yourdomain.com DNS zone, update zone serial and reload it. Don’t forget reate /etc/mail/dkim-milter/trusted-hosts file otherwise dkim-milter daemon will not start. It can be empty file.

5. Now we can try to start dkim-milter service
   Shell

   # service dkim-milter start Starting DomainKeys Identified Mail Milter (dkim-filter): [ OK ]

   1 2 3

   # service dkim-milter start Starting DomainKeys Identified Mail Milter (dkim-filter):  [  OK  ]

   If there is no problems with the configuration and files permissions.

6. Next step is to update sendmail configuration. I assume that you have sendmail-cf package installed and will generate sendmail.cf file from your existing sendmail.mc. Here is what you need to add (assuming that this will be the only milter process you are using).
   addition to /etc/mail/sendmail.mc

   Shell

   INPUT_MAIL_FILTER(`dkim-milter', `S=local:/var/run/dkim-milter/dkim-milter.sock,F=,T=C:10m;S:10m;R:20m;E:20m')dnl

   1	INPUT_MAIL_FILTER(`dkim-milter', `S=local:/var/run/dkim-milter/dkim-milter.sock,F=,T=C:10m;S:10m;R:20m;E:20m')dnl

   Save your updated sendmail.mc and run make all from /etc/mail directory to rebuild sendmail.cf. Try to restart sendmail process:

   Shell

   service sendmail restart Shutting down sm-client: [ OK ] Shutting down sendmail: [ OK ] Starting sendmail: [ OK ] Starting sm-client: [ OK ]

   1 2 3 4 5

   service sendmail restart Shutting down sm-client:                                   [  OK  ] Shutting down sendmail:                                    [  OK  ] Starting sendmail:                                         [  OK  ] Starting sm-client:                                        [  OK  ]

   We will also need to make sure that dkim-milter process will start after next reboot

   Shell

   chkconfig --level 23 dkim-milter on

   1	chkconfig --level 23 dkim-milter on

7. Now here is the tricky part – Gmail and all other major e-mail providers will mark your DKIM verification as failed unless you will have properly configured SPF policy for yourdomain.com. So take some time and put together proper SPF policy for yourdomain.com. The simplest would be “v=spf1 a mx -all”.Add the appropriate TXT record to your DNS zone
   Shell

   yourdomain.com. IN TXT "v=spf1 a mx -all"

   1	yourdomain.com.           IN TXT       "v=spf1 a mx -all"

   , update zone serial and reload the zone. Now you are ready to send signed e-mail which will be verified by capable servers. Keep an eye on /var/log/maillog for dkim-milter messages.

For this configuration I used following sources (Thank you for the information):

• Configuring DKIM and Sendmail on Fedora 13
• Deploy DKIM Milter for Multiple Domains on CentOS 5 with Sendmail(doesn’t need to have domain name in dkim-milter.conf)
• DKIMCore page
• Sender Policy Framework