0

When I scan my DNS Records my DKIM records are found, but when I send an email no DKIM signature is found. Below is the preliminary information I think is needed to help troubleshoot this issue. Any help would be appreciated.

Registrar \ Nameservers: Godaddy Hosting: Digitalocean OS: Ubuntu 14.04

DNS Records (DKIM test websites find the domainkey and indicate no errors):

TXT default._domainkey  v=DKIM1; g=*; k=rsa; p=domainkeygoeshere    600 seconds

Mail:

echo "just a new test" | mail -s "email contents" to@destination.com -aFrom:from@mydomain.com

Reply:

DKIM Information:
DKIM Signature
This message does not contain a DKIM Signature
dkim=none header.d=mydomain.com; x-hmca=none header.id=from@mydomain.com

==========================================================
Summary of Results
==========================================================
SPF check:          pass
DomainKeys check:   neutral
DKIM check:         permerror
SpamAssassin check: ham


"permerror"
  The message could not be verified due to some error that
  is unrecoverable, such as a required header field being
  absent. A later attempt is unlikely to produce a final result.

DKIM Installation (Followed this tutorial):

 https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-dkim-with-postfix-on-debian-wheezy

File: /etc/opendkim/TrustedHosts 

127.0.0.1
localhost
192.168.0.1/24
mydomain.com
12.12.12.12

*.mydomain.com

#*.example.net
#*.example.org

File: /etc/opendkim/KeyTable 

default._domainkey.mydomain.com     mydomain.com:mail:/etc/opendkim/keys/mydomain.com/mail.private

#mail._domainkey.example.net    example.net:mail:/etc/opendkim/keys/example.net/mail.private
#mail._domainkey.example.org   example.org:mail:/etc/opendkim/keys/example.org/mail.private

File: /etc/opendkim/SigningTable 

*@mydomain.com default._domainkey.mydomain.com

#*@example.net mail._domainkey.example.net
#*@example.org mail._domainkey.example.org

root@mydomain:/etc/opendkim/keys/mydomain.com# ls

mail.private  mail.txt
alicia233
  • 27
  • 1
  • 7

1 Answers1

6

Hard to debug with that information, but try to remove _domainkey from your configuration files.

My configuration:

DNS-Record:

TXT   mail._domainkey   v=DKIM1; h=sha256; k=rsa; p=*key*   600

/etc/opendkim.conf:

OversignHeaders         From
Canonicalization        relaxed/relaxed
ExternalIgnoreList      refile:/etc/opendkim/TrustedHosts
InternalHosts           refile:/etc/opendkim/TrustedHosts
KeyTable                refile:/etc/opendkim/KeyTable
LogWhy                  Yes
MinimumKeyBits          1024
Mode                    sv
PidFile                 /var/run/opendkim/opendkim.pid
SigningTable            refile:/etc/opendkim/SigningTable
Socket                  inet:8891@localhost
Syslog                  Yes
SyslogSuccess           Yes
TemporaryDirectory      /var/tmp
UMask                   022
UserID                  opendkim:opendkim

/etc/opendkim/KeyTable:

domain.tld domain.tld:mail:/etc/opendkim/mail

/etc/opendkim/SigningTable:

*@domain.tld domain.tld

/etc/opendkim/TrustedHosts:

127.0.0.1

/etc/postfix/main.cf:

smtpd_milters           = inet:127.0.0.1:8891
non_smtpd_milters       = $smtpd_milters
milter_default_action   = accept

Also check the owner and permissions of the /etc/opendkim/ dir with ls -la, or just set them again with:

chown -Rv opendkim:opendkim /etc/opendkim
chmod go-rwx /etc/opendkim/*

Did you restart postfix and opendkim after configuring them?

service opendkim restart
service postfix restart

I hope this helps somehow and you can find whats wrong.

Oxados
  • 411
  • 3
  • 6
  • I'll give this a shot and tell you where I stand thanks. – alicia233 Nov 16 '16 at 17:29
  • That's so odd. Using the chown + chmod command and restarting the services fixed the problem so my DKIM signature was recognized. Thank you! – alicia233 Nov 16 '16 at 19:29
  • Can I know what is UMASK here? Mor me the Umask is 007. In some websites it is 002. I checked the user id for opendkim. using `id -u opendkim` it is 102. Should I have UMask as 102? @Oxados, @alicia233 – Trect Jun 27 '19 at 06:10
  • @Tessaracter sorry, your linking to my name didn't work so I haven't received a notification of your comment ... better late than sorry: the umask for files in the /etc/opendkim directory should be 700 and be owned by opendkim:opendkim (user + group) – Oxados Apr 13 '20 at 13:16