[SOLVED] DKIM Configuration

windowsdan

Anyone know a way of implementing DKIM into Grommunio? I know it uses postfix on a suse distro but adding dkim proxy and configuring does not make it work when sending emails from Grommunio.

proficleaner

Hello, i use the rspamd DKIM module: https://rspamd.com/doc/modules/dkim_signing.html

windowsdan

proficleaner Thanks for your reply ... I have installed this via zypper after adding the repository and configured using the wizard available ... but still cannot get it to work??

Any ideas ... how did you get the rspamd service to even start as it fails my end completely

crpb

windowsdan
rspamd should already be installed.
zypper info grommunio-antispam
rpm -ql grommunio-antispam |grep rspamd
https://community.grommunio.com/d/11-anti-spam

windowsdan

crpb I can see now that Grommunio is using rspamd under their antispam module]

I have accessed the rspamd web front end to view the status and can see some configuration but can't see a way to configure DKIM using this?

I used this method:

ssh root@<IP ADDRESS OF GROMMUNIO> -L 21334:localhost:11334 then browsing to the web interface

Any help or pointing in the right direction would be great as I have only ever configured DKIM in an Exchange Server setup before using a GUI for key creation and configuration of domains and signing...

crpb

/etc/grommunio-antispam/modules.d/dkim_signing.conf should be your starting-point with the mentioned rspamd-link from @proficleaner

windowsdan

crpb So having configured this file, generated a key and configured the dns it.... is still not dkim signing outgoing mails??

Is there any Grommunio specific config I have to do to enable it to use the rspamd dkim signing for outgoing emails?

obsidiangroup

Really this should be available from the Admin Dashboard or a command-line utility to enable/configure DKIM signing on outgoing emails.

windowsdan

obsidiangroup There is a very easy way to do this I have discovered ....

If you login to the terminal using root and just run:

rspamadm configwizard

Then you can just ignore the other settings but say yes to configuring DKIM ... it's and easy step by step automated config that will run you though it.

Once complete just open the web front-end and restart the grommunio-antispam service and you're done!

antiager

I tried to run configwizard.

It complains about using is as root.

So I added parameter --insecure.

It opens but then got stuck with error message cannot write pidfile!

Any ideas?

Thank you!

antiager

The problem with the configwizard only occurs if you do it directly in the terminal.

If you do it in a ssh session configwizard works!

After setting is up with the configwizard and restarting the services I see the changes in the configfile.

But running a dkim test tool it says the mail is not signet!

I tried to rerun the configwizard but it says no changes found and quits!

How can I reconfigure this?

Thank you for your tips!

antiager

The problem were the permissions of the keyfiles after correcting them everything worked!

But still one question is not answered!

How do I configure a second domain if the config wizard is only running once?

WalterH

As stated in the other thread:
Das ist hier recht gut beschrieben: https://www.rspamd.com/doc/modules/dkim_signing.html
Für jede Domain einen Key anlegen und die Domain in local.d/dkim_signing.conf ergänzen, DNS Einträge nicht vergessen.