Differences

This shows you the differences between two versions of the page.

--- doc:appunti:linux:sa:postfix_opendkim [2022/05/23 11:27] – [Add the domain to be signed] niccolo
+++ doc:appunti:linux:sa:postfix_opendkim [2023/10/31 11:06] (current) – [OpenDKIM on Postfix with virtual domains] niccolo
@@ Line 1: / Line 1: @@
 ====== OpenDKIM on Postfix with virtual domains ======
-In this article we will install **[[http://www.opendkim.org/|OpenDKIM]]** on a GNU/Linux mail server based on **Debian 11 Buster**. The mail service is provided by **Postfix** configured for virtual domains using **virtual_alias_domains**.
+In this tutorial we will install **[[http://www.opendkim.org/|OpenDKIM]]** on a GNU/Linux mail server based on **Debian 11 Buster**. The mail service is provided by **Postfix** configured for virtual domains using **virtual_alias_domains**.
 <code>
 apt install opendkim opendkim-tools
 </code>
+In Debian 11 Bullseye the service is controlled (enable, start, stop, etc.) by Systemd:
+<code>
+systemctl status opendkim.service
+</code>
+Because Postfix is running into a chroot, it cannot access the ''/run/opendkim/opendkim.sock'' Unix socket to communicate with opendkim, so we change the ''Socket'' option into **/etc/opendkim.conf** and make the daemon to be listening on port **127.0.0.1:8891/TCP**:
+<file>
+Socket  inet:8891@localhost
+</file>
+The same daemon is used both for signing and verifying. Signing is performed when the client connecting to the MUA is authenticated and the **From:** address matches the domains to be signed (see the command line option **%%-d%%** or the **SigningTable** option of the ''/etc/opendkim.conf'' configuration file), verifying is performed in other cases.
 ===== Create the keys in /etc/dkimkeys/ =====
@@ Line 63: / Line 77: @@
 ===== Configure OpenDKIM =====
-Into the **/etc/opendkim.conf** file we infor OpenDKIM to look into a **KeyTable** to find keys and into a **SigningTable** to know which domains require signing. The service will listen on port **8891/TCP** (should use //Unix domain socket// instead? Better performances? More painfull because Postfix runs in chroot).
+Into the **/etc/opendkim.conf** file we inform OpenDKIM to look into a **KeyTable** to find keys and into a **SigningTable** to know which domains require signing. The service will listen on port **8891/TCP** (should use //Unix domain socket// instead? Better performances? More painfull because Postfix runs in chroot).
 <file>
@@ Line 120: / Line 134: @@
 </file>
-Havig done this, we define the custom **mua_milters** directive in ''main.cf'' to apply SpamAssassin and DKIM filtering on sumbitted messages:
+Having done this, we define the custom **mua_milters** directive in ''main.cf'' to apply SpamAssassin and DKIM filtering on sumbitted messages:
 <file>
-# Locally generated mails are filtered with OpenDKIM.
+# Locally generated mails (e.g. from command line Mutt) are filtered with OpenDKIM.
 non_smtpd_milters = inet:localhost:8891
-# Uncomment if you want OpenDKIM for all the messages received by SMTPD.
+# Mails received via SMTP protocol are filtered with OpenDKIM;
-#smtpd_milters = inet:localhost:8891
+# messages created using SoGO webmail go through this milter.
+smtpd_milters = inet:localhost:8891
-# Restriction applied as smtpd_milters over SUMBISSION/587 only.
+# Filters applied (as smtpd_milters) to messages received via SUMBISSION/587;
 mua_milters =
     unix:spamass/spamass.sock,
     inet:localhost:8891
+</file>
+Another important Postfix setting is **milter_default_action**, the default is **tempfail** which means that if the milter does not respond, the message will be held into the queue and retried later. Other settings can be **accept** or **reject**:
+<file>
+milter_default_action = tempfail
 </file>