DomainKeys Identified Mail (DKIM) is a method for validating the identity associated with a message using using public-key cryptography and key server technology. DKIM is an enhanced version of Yahoo's Domain Keys and Cisco's Identified Internet Mail methods. As of February 2007 an IETF draft was accepted as "Proposed standard", it may take some more time till this will be a standard but the current version is stable ( according to dkim.org ).
Implementations of DKIM in email servers is not available as much as DomainKeys.
For qmail there is a patch that uses libdomainkeys to implement a replacement for qmail-queue that will verify and sign messages but this only works for DomainKeys not DKIM. I have developed a solution for qmail to be able to verify and sign messages with DKIM.
My solution was inspired by a post on the qmail list http://article.gmane.org/gmane.mail.qmail.general/52049 that used two shell scripts one as a qmail-queue wrapper for verifying the messages and one as a qmail-remote wrapper for signing the messages. Both scripts call dktest, a test program that comes with libdomainkeys, to do the signing and verification.
Libdkim is a portable implementation of the DKIM drafts and it comes with a test program, libdkimtest somehow similar to dktest so I'm using this to do the signing and verification.
Although libdkim developers claim it is portable it needed some patching to make it compile on Linux, mainly some macro definitions that are only available in windows header files. I found those definitions in a file macros.h from mono and I added it to libdkim's source and included it in dkim.h .
I also added some small features and enhancements like a help / usage message for libdkimtest, the ability to specify the domain and selector in the command line. I removed some hard coded defaults that blocked options specified on the command line and I made it be able to process messages that had bare LF as line terminators instead of CR/LF.
The shell scripts that used dktest also needed some small modifications because libdkimtest does not read the message on it's standard input and it does not output the message to the standard output.
Here is the shell script that does the verification:
This should replace qmail-queue and to make it verify the messages you have to set the DKIMVERIFY environmental variable. This script calls qmail-dk because I want to also verify the DomainKeys signature.
and here is the script that should replace qmail-remote:
copy qmail-remote to qmail-remote.orig and then name this script qmail-remote
get libdkim, unzip it, get these patches : libdkim linux compile patch and libdkim extra options patch
and apply then like this
If you had qmail-dk working before then the scripts will just use the private keys in /etc/domainkeys/{domain_name}/default just like qmail-dk .
Update:
because some people had troubles applying the patches to newer versions of libdkim I have added the patched source code here: libdkim-patched.tar.gz
It would still be a good idea to patch the newer versions and I might do that when I find some time.
The signatures are different by what they sign and how they sign it.
This probably has something to do with the versions of libdkim that you’re using and you can probably control it through some parameter to libdkimtest.
I wouldn’t worry about removing extra signatures but if your server signs a lot of messages this might put too much load on the server.
hm I see, I currently can’t test this anymore right now because someone started sending mail through the server again when I was suppose tohave exclusive access to it. so they sent out a few tens of thousands of emaisl with invalid dkim signatures haha
anyway until I can look at this again do you have any what causes this?
this is from dkim-test@altn.com
dkim=neutral header.d=xh.com (b=Hr6JR1QX2y; 1:-2:DKIM_BAD_SYNTAX); header.d=xh.com (b=QrgP7FPews; 2:-2:DKIM_BAD_SYNTAX); header.d=xh.com (b=NgpRYX/i8V; 3:-2:DKIM_BAD_SYNTAX);
I am setting domain with -d flag to libdkimtest, what should be the format of this argument if not domain.com? or is this some other problem …
using libdkim 1.0.21 patched with your extra options patch
I don’t know exactly what the d flag does. It might not work as it should.
As you can see I don’t set any domain , I let libdkimtest determine the domain from the From: or Sender: headers in the message
I finally got this going but I had to
1) revert to the patched version of libdkim on here vs patching the newest version
2) in the bash script set the -i (email address) and -d (domain) switches manually which in my case is ok since only one email address is sending.
In my case logs got full , i cleared logs and mails started delivering