How to use DKIM with CentOS 5 and Exim?

[admin]

If you're sending any newsletters you really want to be investigating this, if you're doing anti spam it's good to start looking at tracking this and really everyone should have DKIM on their domains. Exim recently - as of 4.70 - have decent support for it but CentOS is still on 4.63 thanks to RHEL.

To get a new Exim on your CentOS machine I suggest just using ATrpms, http://atrpms.net/dist/el5/,  who as of writing has 4.71 packages available for Exim and the other bits you need.:

exim-4.71-40.el5.i386.rpm

As well as the 64bit versions, you can just add ATrpms to your systems but really you should have your own repos and carefully control the packages that goes out to your estate.

Also you should be already installed the libdkim

Once you have upgraded your stock Exim to these versions - it's a totally clean and compatible upgrade - configuring Exim to automagically sign outgoing mail with DKIM is pretty easy. We'll make it so it looks for keys in a specific location based on outgoing mail domain so if you're a relay for many domains you just need to drop down the certs.

Put the following near the top of our /etc/exim/exim.conf file, this just sets some macros we'll use later on:

Code: [Select]

DKIM_DOMAIN = ${lc:${domain:$h_from:}}
DKIM_FILE = /etc/exim/dkim/${lc:${domain:$h_from:}}.pem
DKIM_PRIVATE_KEY = ${if exists{DKIM_FILE}{DKIM_FILE}{0}}
This will use, based on sender domain, a private key in /etc/exim/dkim/sender_domain.pem. By default exim just logs DKIM verification, doesn't block any incoming mail I won't cover doing blocks here just sending.

Next find your remote_smtp transport later in the file and change it to look like this:

Code: [Select]

remote_smtp:
  driver = smtp
  dkim_domain = DKIM_DOMAIN
  dkim_selector = x
  dkim_private_key = DKIM_PRIVATE_KEY
  dkim_canon = relaxed
  dkim_strict = 0
This will make Exim do the DKIM signing on outgoing mail but only if it can find a certificate.

To make the certificates is pretty easy, we'll use a domain example.com:

Code: [Select]

$ mkdir /etc/exim/dkim/ && cd /etc/exim/dkim/
$ openssl genrsa -out example.com.pem 768
$ openssl rsa -in example.com.pem -out example.com-public.pem -pubout -outform PEM
All that's left now is to update your dns, sticking to example.com you'd add something like this into your bind zone file the text to add after p= is the stuff you'll find in the public key called example.com-public.pem in our example:

Code: [Select]

x._domainkey     IN      TXT     "v=DKIM1\; t=y\; k=rsa\; p=MIGfMA0<snip>AQAB"
_domainkey       IN      TXT     "t=y\; o=~\;"
The x matches up with your dkim_selector in the SMTP transport above. The t=y tells the world you're still testing your setup so remove that only when you're all 100% certain it works. The o=~ tells everyone you will sign only some mail. You can make that o=- if all mail from you would be signed.

You can verify your DNS is right like this:

Code: [Select]

$ dig +short txt x._domainkey.example.com
"v=DKIM1\; k=rsa\; p=MIGfMA0<snip>AQAB"
And finally if you're sending mail you should now see a header in the mail like this:

Code: [Select]

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=example.com; s=x;
h=From:To:Message-Id:Date; bh=g3zLY<snip>5uGs=; b=fonAB<snip>bceHhQ==;
Of caerse you should restart namedb and Exim:

Code: [Select]

service namedb restart
service exim restaet
Finally you can send an email to check-auth@verifier.port25.com and it will reply with all sorts of test output about your domain including DKIM validation details.

If you got error dkim=permerror (key failed) like:
 

Code: [Select]

Authentication-Results: mta1045.mail.sk1.yahoo.com from=developers-heaven.net; domainkeys=neutral (no sig); from=developers-heaven.net; dkim=permerror (key failed)

 

Then you have to check the key you entered in the DNS and insure it's without any line break may you need to change it for your domain under /etc/named/
Good luck