Re: DKIM setup in Winterfell
Milan Petrovic <[email protected]>
| Newsgroups | gmane.comp.kde.devel.kroupware |
|---|---|
| Message-ID | <CAPGMBarcJ10J=x4BEtm9JHvwM1SwU7e5mZPAdb5s5sft64Z+QA@mail.gmail.com> |
I can't believe noone has ever setup DKIM in Kolab 16 or Winterfell... On Tue, Oct 8, 2019 at 9:34 PM Milan Petrovic <[email protected]> wrote: > Has anyone been setting the DKIM up in Winterfell? > > On Wed, Oct 2, 2019 at 2:05 AM Milan Petrovic <[email protected]> > wrote: > >> Is there any difference in setting up the DKIM signing through Amavis in >> Winterfell as compared to earlier versions (I'm referring to the available >> guides in Kolab doc)? >> >> I'm trying to set it up, following the doc guide thoroughly, but I keep >> getting the verification failed (not only through some online checking >> services, but also GMail as a recipient finds the same). >> >> My amavisd.conf looks like this: >> >> ... >> $inet_socket_port = [10023,10024]; # listen on multiple TCP ports >> >> $interface_policy{'10023'} = 'SUBMISSION'; >> $policy_bank{'SUBMISSION'} = { >> originating => 1, >> smtpd_discard_ehlo_keywords => >> ['[email protected]'] >> }; >> ... >> dkim_key( >> 'mydomain.com', >> 'dkim20092019', >> '/etc/amavisd/dkim/mydomain.com.dkim20092019.pem' >> ); >> @dkim_signature_options_bysender_maps = ( >> { >> "mydomain.com" => { >> d => 'mydomain.com', >> a => 'rsa-sha256', >> ttl => 10*24*3600, >> c => 'relaxed/simple' >> } >> } >> ); >> >> 1; # insure a defined return value >> >> >> And my master.cf: >> ... >> submission inet n - n - - smtpd >> -o cleanup_service_name=cleanup_submission >> -o syslog_name=postfix/submission >> -o smtpd_tls_security_level=encrypt >> -o smtpd_sasl_auth_enable=yes >> -o smtpd_sasl_authenticated_header=yes >> -o smtpd_client_restrictions=permit_sasl_authenticated,reject >> -o smtpd_data_restrictions=$submission_data_restrictions >> -o smtpd_recipient_restrictions=$submission_recipient_restrictions >> -o smtpd_sender_restrictions=$submission_sender_restrictions >> -o content_filter=smtp-amavis:[127.0.0.1]:10023 >> -o >> receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters >> ... >> smtp-amavis unix - - n - 3 smtp >> -o smtp_data_done_timeout=1800 >> -o disable_dns_lookups=yes >> -o smtp_send_xforward_command=yes >> -o max_use=20 >> -o smtp_bind_address=127.0.0.1 >> >> # Listener to re-inject email from Amavisd into Postfix >> 127.0.0.1:10025 inet n - n - 100 smtpd >> -o cleanup_service_name=cleanup_internal >> -o content_filter=smtp-wallace:[127.0.0.1]:10026 >> -o local_recipient_maps= >> -o relay_recipient_maps= >> -o smtpd_restriction_classes= >> -o smtpd_client_restrictions= >> -o smtpd_helo_restrictions= >> -o smtpd_sender_restrictions= >> -o smtpd_recipient_restrictions=permit_mynetworks,reject >> -o mynetworks=127.0.0.0/8 >> -o smtpd_authorized_xforward_hosts=127.0.0.0/8 >> >> # Filter email through Wallace >> smtp-wallace unix - - n - 3 smtp >> -o smtp_data_done_timeout=1800 >> -o disable_dns_lookups=yes >> -o smtp_send_xforward_command=yes >> -o max_use=20 >> >> # Listener to re-inject email from Wallace into Postfix >> 127.0.0.1:10027 inet n - n - 100 smtpd >> -o cleanup_service_name=cleanup_internal >> -o content_filter= >> -o local_recipient_maps= >> -o relay_recipient_maps= >> -o smtpd_restriction_classes= >> -o smtpd_client_restrictions= >> -o smtpd_helo_restrictions= >> -o smtpd_sender_restrictions= >> -o smtpd_recipient_restrictions=permit_mynetworks,reject >> -o mynetworks=127.0.0.0/8 >> -o smtpd_authorized_xforward_hosts=127.0.0.0/8 >> >> >> Sending a test mail to [email protected], among others, >> gives the following result: >> DKIM_INVALID DKIM or DK signature exists, but is not valid >> >> Similar thing happens with dkimvalidator.com: >> >> Validating Signature >> result = fail >> Details: message has been altered >> >> All mails are sent through Roundcube. >> >> >> On the other hand, the mxtoolbox' dkim verifier passes. Also the 'amavisd >> ... testkeys" gives a "pass". >> >> Excerpt from the amavis' log (everything looks normal to me here): >> ... >> Oct 02 01:31:04 mail.mydomain.com amavis[11404]: (11404-02) header: >> Received: from mail.mydomain.com ([127.0.0.1])\n\tby localhost ( >> mail.mydomain.com [127.0.0.1]) (amavisd-new, port 10028)\n\twith ESMTP >> id GWd2ey-29lPr for <[email protected]>;\n\tWed, 2 Oct 2019 >> 01:31:03 +0200 (CEST)\n >> Oct 02 01:31:04 mail.mydomain.com amavis[11404]: (11404-02) headers >> CLUSTERING: done all 1 recips in one go >> Oct 02 01:31:04 mail.mydomain.com amavis[11404]: (11404-02) dkim: >> candidate originators: From:<[email protected]> >> Oct 02 01:31:04 mail.mydomain.com amavis[11404]: (11404-02) query_keys: >> cached [email protected] >> Oct 02 01:31:04 mail.mydomain.com amavis[11404]: (11404-02) lookup_hash( >> [email protected]) matches keys: "mydomain.com"=>HASH(0x23176e8) >> Oct 02 01:31:04 mail.mydomain.com amavis[11404]: (11404-02) lookup >> [dkim_signature_options_bysender], 1 matches for "[email protected]", >> results: "mydomain.com >> "=>{c=>"relaxed/simple",a=>"rsa-sha256",ttl=>"864000",d=>"mydomain.com"} >> Oct 02 01:31:04 mail.mydomain.com amavis[11404]: (11404-02) dkim: >> signature options for [email protected](From): c=relaxed/simple; >> a=rsa-sha256; ttl=864000; d=mydomain.com >> Oct 02 01:31:04 mail.mydomain.com amavis[11404]: (11404-02) dkim: >> signing (author), From: <[email protected]> (From:<[email protected]>), >> KEY.key_ind=>0, a=>rsa-sha256, c=>relaxed/simple, d=>mydomain.com, >> s=>dkim20092019, ttl=>864000, x=>1570836664 >> Oct 02 01:31:04 mail.mydomain.com amavis[11404]: (11404-02) >> write_header: 1, Amavis::Out::SMTP=HASH(0x785b2b8) >> Oct 02 01:31:04 mail.mydomain.com amavis[11404]: (11404-02) header >> encoded (all-ASCII): DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; >> d=\n\tmydomain.com; >> h=message-id:user-agent:subject:subject:from\n\t:from:date:date:content-type:content-type:mime-version:received\n\t:received; >> s=dkim20092019; t=1569972663; x=1570836664; >> bh=6RpSO+\n\tmd9nsAq4tGBITXXERkubt1wZSk8UUAVzpwGXo=; >> b=YAkS7Condre4YKZhQidgwl\n\tJEd0Nr73oanUkhOOw7y+hCnwdYWp6yqN5fUhLmAHkg4x7t0URo7SIyoq9Vz6yS9D\n\tSF1GJVLzXIGM/Lcijsa7bFs21WGWW0k4CrsA0YBmtqtPrgk/iTGM/MlWFTIBIzsl\n\tBkRB1mlZYgcUIFMzLuSYpAVlck5r5P0u9YpiDd84Q2HMjoSgu4iQauCN9bO+qLEh\n\tsqzRt40AbABmMpsZT/BQwnnsGjJadHnWXOesl8jrjkMuObMznIxhUt0WwlossViG\n\tp2rOY25WBlcn0lDxX6fqEqGkE2lyqzylSAbH1zd0dSCMnVf1Gy2zBpkmOzHW1hDK\n\tkutMGhEjtcEq+wDjNj4ZUuor0GiHFpR+ipXnIuH8+AdJNVvPMLYKtrNeo8ANw5x2\n\tQ97kD6cB/NzXnB1ukqipEdR/RBK2TytYakQaspmwtii+B3Huryl3Vn+Fbgl3hZbf\n\tseE+4dV2APJcUgo3djB3VDnbr8+HAqBrjn4R1RaTDnwNfaRGqRzeSCpy6bTVh1JS\n\tQNzAG2+cKOK36MCm0NeLZNI7RM590t9ZBmZQRgxf6E4pPBrdbZ1AhfXkIQ+tPuX... >> Oct 02 01:31:04 mail.mydomain.com amavis[11404]: (11404-02) >> ...m\n\tj1YnOl9AzPw14xi06cDy6JTa3iHmUY6w9fptwLKf+GghI8q7pnZDadUTfvtFfvBz\n\tP7P5rXiCbHeY+e7U72Nnk= >> Oct 02 01:31:04 mail.mydomain.com amavis[11404]: (11404-02) header: >> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=\n\tmydomain.com; >> h=message-id:user-agent:subject:subject:from\n\t:from:date:date:content-type:content-type:mime-version:received\n\t:received; >> s=dkim20092019; t=1569972663; x=1570836664; >> bh=6RpSO+\n\tmd9nsAq4tGBITXXERkubt1wZSk8UUAVzpwGXo=; >> b=YAkS7Condre4YKZhQidgwl\n\tJEd0Nr73oanUkhOOw7y+hCnwdYWp6yqN5fUhLmAHkg4x7t0URo7SIyoq9Vz6yS9D\n\tSF1GJVLzXIGM/Lcijsa7bFs21WGWW0k4CrsA0YBmtqtPrgk/iTGM/MlWFTIBIzsl\n\tBkRB1mlZYgcUIFMzLuSYpAVlck5r5P0u9YpiDd84Q2HMjoSgu4iQauCN9bO+qLEh\n\tsqzRt40AbABmMpsZT/BQwnnsGjJadHnWXOesl8jrjkMuObMznIxhUt0WwlossViG\n\tp2rOY25WBlcn0lDxX6fqEqGkE2lyqzylSAbH1zd0dSCMnVf1Gy2zBpkmOzHW1hDK\n\tkutMGhEjtcEq+wDjNj4ZUuor0GiHFpR+ipXnIuH8+AdJNVvPMLYKtrNeo8ANw5x2\n\tQ97kD6cB/NzXnB1ukqipEdR/RBK2TytYakQaspmwtii+B3Huryl3Vn+Fbgl3hZbf\n\tseE+4dV2APJcUgo3djB3VDnbr8+HAqBrjn4R1RaTDnwNfaRGqRzeSCpy6bTVh1JS\n\tQNzAG2+cKOK36MCm0NeLZNI7RM590t9ZBmZQRgxf6E4pPBrdbZ1AhfXkIQ+tPuXm\n\tj1YnOl9AzPw14xi0... >> Oct 02 01:31:04 mail.mydomain.com amavis[11404]: (11404-02) >> ...6cDy6JTa3iHmUY6w9fptwLKf+GghI8q7pnZDadUTfvtFfvBz\n\tP7P5rXiCbHeY+e7U72Nnk=\n >> ... >> >> So, is there anything different I should do while setting up the DKIM in >> Winterfell? >> >> _______________________________________________ users mailing list [email protected] https://lists.kolab.org/mailman/listinfo/users