DKIM on postfix and bind

Open dkim on postfix

yum install opendkim

## cp /etc/opendkim.conf{,.orig}

## vim /etc/opendkim.conf

AutoRestart             Yes

AutoRestartRate         10/1h

LogWhy                  Yes

Syslog                  Yes

SyslogSuccess           Yes

Mode                    sv

Canonicalization        relaxed/simple

ExternalIgnoreList      refile:/etc/opendkim/TrustedHosts

InternalHosts           refile:/etc/opendkim/TrustedHosts

KeyTable                refile:/etc/opendkim/KeyTable

SigningTable            refile:/etc/opendkim/SigningTable

SignatureAlgorithm      rsa-sha256

Socket                  inet:8891@localhost

PidFile                 /var/run/opendkim/opendkim.pid

UMask                   022

UserID                  opendkim:opendkim

TemporaryDirectory      /var/tmp

Generate set of keys for your mydomain.com domain name:

## mkdir /etc/opendkim/keys/mydomain.com

## opendkim-genkey -D /etc/opendkim/keys/mydomain.com/ -d mydomain.com -s default

## chown -R opendkim: /etc/opendkim/keys/mydomain.com

## mv /etc/opendkim/keys/mydomain.com/default.private /etc/opendkim/keys/mydomain.com/default

add mydomain.com to OpenDKIM’s key table by adding the following record in /etc/opendkim/KeyTable

default._domainkey.mydomain.com mydomain.com:default:/etc/opendkim/keys/mydomain.com/default

next, edit /etc/opendkim/SigningTable and add the following record to OpenDKIM’s signing table:

*@mydomain.com default._domainkey.mydomain.com

And add your domain and your hostname as trusted hosts in /etc/opendkim/TrustedHosts  

127.0.0.1

mydomain.com

host.mydomain.com

assuming the domain in question is ‘mydomain.com’ and server’s hostname is set to ‘host.mydomain.com’

finally, edit your mydomain.com DNS zone and add the TXT record from

/etc/opendkim/keys/mydomain.com/default.txt

default._domainkey      IN      TXT     ( "v=DKIM1; k=rsa; "

          "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDApHRr7ZmXRaAB+RQRbP4VdMwIrIHIP18KFtXRsv/xpWc0Gix6ZXN13fcG03KNGKZo2PY+csPkGC5quDnH5V0JEhDZ78KcDWFsU6u4fr9ktVAdt6P7jWXjcyqdHOZ8+YN4cAeU4lRFNgQvdupIcByYwzPYMgBFHfJm9014HvRqhwIDAQAB" )  ; ----- DKIM key default for mydomain.com

Verify by 

## dig +short default._domainkey.mydomain.com TXT

CONFIGURE POSTFIX

In order to integrate OpenDKIM with Postfix we need to add the following few lines in /etc/postfix/main.cf:

smtpd_milters           = inet:127.0.0.1:8891
non_smtpd_milters       = $smtpd_milters
milter_default_action   = accept
milter_protocol         = 2

## service opendkim start
## chkconfig opendkim on
## service postfix restart

 ## cp /etc/opendkim.conf{,.orig}
## vim /etc/opendkim.conf

AutoRestart             Yes  #Automatically re-start on failures.  Use with caution; if the filter fails instantly after it starts, this can cause a tight fork(2) loop

AutoRestartRate         10/1h  # This is a string of the form n/t[u] where n is an integer limiting the count of restarts in the given interval and t[u] defines the time  inter‐
              val  through which the rate is calculated;

LogWhy                  Yes # If  logging is enabled (see Syslog below), issues very detailed logging about the logic behind the filter's decision to either sign a message or verify it
Syslog                  Yes

SyslogSuccess           Yes #Log via calls to syslog(3) additional entries indicating successful signing or verification of messages.

Mode                    sv   # Valid modes  are  s
              (signer)  and  v (verifier).  The default is sv except in test mode (see the opendkim(8) man page) in which case the default is v.  When signing
              mode is enabled, one of the following combinations must also be set: (a) Domain, KeyFile, Selector, no KeyTable, no SigningTable; (b)  KeyTable,
              SigningTable, no Domain, no KeyFile, no Selector; (c) KeyTable, SetupPolicyScript, no Domain, no KeyFile, no Selector.


Canonicalization        relaxed/simple   #  Selects the canonicalization method(s) to be used when signing messages.  When verifying, the message's DKIM-Signature: header  field  specifies
              the  canonicalization  method.   The recognized values are relaxed and simple as defined by the DKIM specification.  The default is simple.  The
              value may include two different canonicalizations separated by a slash ("/") character, in which case the first will be applied  to  the  header
              and the second to the body.


ExternalIgnoreList      refile:/etc/opendkim/TrustedHosts
InternalHosts           refile:/etc/opendkim/TrustedHosts
KeyTable                refile:/etc/opendkim/KeyTable
SigningTable            refile:/etc/opendkim/SigningTable
SignatureAlgorithm      rsa-sha256
Socket                  inet:8891@localhost
PidFile                 /var/run/opendkim/opendkim.pid
UMask                   022
UserID                  opendkim:opendkim
TemporaryDirectory      /var/tmp