HOWTO: Qmail and DomainKeys Identified Mail (DKIM) Signing

lmegliol · n00b Joined: 12 Sep 2005 Posts: 68

Disclaimer: I'm no expert system administrator now am I an expert documentation writer, therefore the process I followed to get DKIM signing working on my system may not be the best way or the most secure way of getting it working. I don't know of any particular problems with this method, but I'll leave that up to other people to determine. Comments and improvements on the following are more than welcome. I probably won't be able to give to much assistance with questions.

I wanted to get DomainKeys Identified Mail (DKIM) setup with qmail to sign my outgoing messages. There is a fair amount of documentation out there about getting this done, but there are a few different approaches, and I wasn't able to get all of them working. The following is the way that I managed to get it working.

Prerequesites:

qmail is installed
Perl is installed

I used the instructions at the following link to install qmail:
https://forums.gentoo.org/viewtopic-t-539101-highlight-qmail.html

I assume that my instructions will only work if you also following those instructions.

Use CPAN to install Mail::DKIM Perl module. I did not check to see whether this was available as an ebuild.

Code:

# cpan
cpan> install Mail::DKIM

CPAN may require that you install other modules on which Mail::DKIM depends. Say yes when prompted for those modules.

cpan> quit
Some instructions for getting DKIM working talk about the dkimsign.pl program that comes with the Mail::DKIM Perl module. This script was not installed when the module was installed, but I did find it in the CPAN cuild directory. For me:

Code:

# cp /root/.span/build/Mail-DKIM-0.30.1-XXXXXX/scripts/dkimsign.pl /usr/local/bin

Where XXXXXX is a seemingly random string of characters.
You may be able to find the script using:

Code:

# find / -name dkimsign.pl -print

Apply the following patch to that script:

Code:

diff -ru orig/dkimsign.pl modified/dkimsign.pl
--- orig/dkimsign.pl 2008-02-20 21:51:34.000000000 -0700
+++ modified/dkimsign.pl 2008-02-20 21:50:19.000000000 -0700
@@ -22,6 +22,7 @@
my $expiration;
my $identity;
my $key_protocol;
+my $key;
my @extra_tag;
my $debug_canonicalization;
my $binary;
@@ -34,6 +35,7 @@
      "domain=s" => \$domain,
      "expiration=i" => \$expiration,
      "identity=s" => \$identity,
+    "key=s" => \$key,
      "key-protocol=s" => \$key_protocol,
      "debug-canonicalization=s" => \$debug_canonicalization,
      "extra-tag=s" => \@extra_tag,
@@ -61,7 +63,7 @@
      Algorithm => $algorithm,
      Method => $method,
      Selector => $selector,
-    KeyFile => "private.key",
+    KeyFile => $key,
      Debug_Canonicalization => $debugfh,
      );

To apply:

Code:

# patch -p1 -l < dkimsign.pl.patch

This patch just allows the private key to be specified on the command line. This is particularly important if you will be signing email messages from multiple domains.

Code:

# emerge -av libdomainkeys
Code:

# mkdir /etc/domainkeys
For each domain for which you would like to have messages signed:

Code:

# mkdir /etc/domainkeys/DOMAIN.TLD
# cd /etc/domainkeys/DOMAIN.TLD
# dknewkey default 1024 > default.pub

That directory will now have the public and private keys for the domain.
Code:

# chown -R root:qmail /etc/domainkeys
Code:

# chmod -R g=u-w,o= /etc/domainkeys
Add user qmailr to qmail group:

Code:

# usermod -a -G qmail qmailr
Code:

# mv /var/qmail/bin/qmail-remote /var/qmail/bin/qmail-remote.orig

Save the following script as /var/qmail/bin/qmail-remote

Code:

#!/bin/bash

[ "$DKSIGN" ] || DKSIGN="/etc/domainkeys/%/default"
[ "$DKREMOTE" ] || DKREMOTE="/var/qmail/bin/qmail-remote.orig"

if [[ $DKSIGN == *%* ]] ; then
DOMAIN=${2##*@}
DKSIGN="${DKSIGN%%%*}${DOMAIN}${DKSIGN#*%}"
fi

if [ -f "$DKSIGN" ] ; then

tmp=`/bin/mktemp -t dk.sign.XXXXXXXXXXXXXXXXXXX`

/bin/cat - >"$tmp"

( /usr/bin/dktest -s "$DKSIGN" -c nofws -h < "$tmp" 2>/dev/null | /bin/sed 's/; d=.*;/; d='"$DOMAIN"';/' ;
/usr/local/bin/dkimsign.pl --type=dkim --selector=default --key="$DKSIGN" --method=relaxed <"$tmp" | /usr/bin/tr -d '\r' ;
/bin/cat "$tmp" ) | "$DKREMOTE" "$@"

retval=$?
/bin/rm "$tmp"
exit $retval
else
exec "$DKREMOTE" "$@"
fi

Code:

# chown root:qmail /var/qmail/bin/qmail-remote
Code:

# chmod 755 /var/qmail/bin/qmail-remote
For each domain for which you want messages signed, you will need to add two TXT records to DNS. To start, add the following two records:

Code:

_domainkey.DOMAIN.TLD IN TXT "t=y; o=~"

Code:

default._domainkey.DOMAIN.TLD IN TXT "t=y; k=rsa p=PUBLIC_KEY"

Replace PUBLIC_KEY above with the public key in /etc/DOMAIN.TLD/default.pub. The public key will following the "p=" in that file.
The "t=y" means that you are just testing this domain key for now. Remove that from the TXT records when you are certain that everything is working.
The "o=~" in the first TXT record means that you will not be signing every email message sent by the domain. If you will be signing every email message from the domain, set that to "o=-".

There is one problem that I seem to have come across so far. If you are using /var/qmail/control/smtproutes to route your email through another SMTP server, and if you are using a username and password in that file to AUTH your connetion, it may no longer work. Mine stopped working when I setup DKIM. I did not really need it, so I just stopped using it. Using smtproutes without AUTH continued to work.

Some of the resources I used to get this working:
http://www.memoryhole.net/qmail/
http://patchlog.com/security/qmail-and-dkim/
http://qmail.jms1.net/patches/domainkeys.shtml

Again, any suggestions and improvements to these instructions are welcome. If there are any known security issues with this setup, please let me know.

r00t440 · Tux's lil' helper Joined: 14 Sep 2005 Posts: 93

Hi! I think your guide totally rocks. It's very true that there's very limited resources on how to setup qmail + DKIM. Most of them are very cryptic and not so n00b friendly.

You mentioned that you didn't check if there's any ebuild for "Mail::DKIM", there's actually one and it's called "dev-perl/Mail-DKIM". I wasn't able to install "Mail::DKIM" manually as stated on your guide, it gives me a compile error. But, doing "emerge dev-perl/Mail-DKIM" works just fine.

How about revising your howto into a more "Gentoo" way, I mean using "emerge"?

After emerging Mail-DKIM, I can't seem to find the file: "dkimsign.pl" so I'm stuck again at implementing this DKIM stuff. I have a very simple qmail installation and I need DKIM to work because all my sent mail goes to spam folder of Yahoo, GMail, Hotmail, I guess every email service provider. I was able to make SPF working and probably DKIM is the only thing that prevents my sent mail from going to the Inbox of these email service providers. My email server configuration is "qmail-vpopmail-dovecot".

I guess your guide must be posted on Gentoo-Wiki.

Thanks and more power!

Evileye · l33t Joined: 06 Aug 2003 Posts: 782 Location: Toronto

I am having a problem with the patching part. I created a file called "dkimsign.pl.patch" in /usr/local/bin/ when dkimsign.pl is located then ran following command...

lmegliol · n00b Joined: 12 Sep 2005 Posts: 68

lmegliol · n00b Joined: 12 Sep 2005 Posts: 68

Evileye · l33t Joined: 06 Aug 2003 Posts: 782 Location: Toronto

ok, I have 2 problems...

1) When I use this site to test my domain key it says the following..

lmegliol · n00b Joined: 12 Sep 2005 Posts: 68

I can only make guesses as to what the problem is and suggestions on some things to try.

In your TXT records...

Evileye · l33t Joined: 06 Aug 2003 Posts: 782 Location: Toronto

Here is your patch...

lmegliol · n00b Joined: 12 Sep 2005 Posts: 68

I'm sorry, but I have no idea. If it wasn't clear from my earlier posts, I am no expert at this. It took quite a bit of fumbling for me to get this working for myself.

All I can tell you is that when I email Yahoo I do not receive the error that you do.