Re: I would like to move from a QMail setup but what about DKIM, DMARC and SFP? (Issue #57)

On Sat 25/Jan/2025 08:50:37 +0100 Bernd Wurst wrote:
> Am 25.01.25 um 04:26 schrieb Philip Rhoades via courier-users:
>> Anyone done DKIM and DMARC?
> 
> We moved from QMail to courier long time ago.
> 
> DKIM and DMARC can be implemented using zdkimfilter by Alessandro Vesely, which 
> can be found at
> https://www.tana.it/sw/zdkimfilter/
> We're quite happy with this implementation. Not necessarily with DMARC itself 
> but that's another issue. :)


DMARC is disabled by default.  It can be enabled on a per-domain basis.


> This filter signs messages that come to the mailserver via authenticated SMTP. 
> Keep in mind that messages submitted locally with sendmail or unauthenticated 
> via 127.0.0.1 (e.g. from PHP scripts) are not getting signed. All modern web 
> apps can use authenticated SMTP, so it's not a problem at all but you should 
> know about.


Personally, I find it more comfortable to sign local mail offline, just before 
sendmail.  For example, I send complaints like so:

zdkimsign -f zsign_rsa.conf --filter --domain tana.it |\
zdkimsign -f zsign_ed25519.conf --filter --domain tana.it |\
sendmail -f [email protected]

Where a local config file can override selected settings:

include /etc/courier/filters/zdkimfilter.conf
override domain_keys = /etc/courier/filters/ekeys
override sign_hfields = \
 From Author Subject Date To Cc List-Unsubscribe List-Unsubscribe-Post


Best
Ale
-- 






_______________________________________________
courier-users mailing list
[email protected]
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users