How to setup DKIM?

mlowijs

Hi, new to grommunio and couldn't really find a comprehensive answer.

I installed the latest version of grommunio and setup a domain with all required DNS records and e-mail sending and receiving seems to work.

I created a DKIM keypair through the admin interface, and put the DKIM record in the DNS as well.
However, when sending emails, they are not signed and the DKIM header is not added to the email.

How can I make it so that emails are properly signed?

Thanks!

Steakie

The DKIM key also needs to be manually copied to the correct location of grommunio-antispam, because the AAPI does not have access rights to automatically write to the correct location.

cp /var/lib/grommunio-admin-api/[youKey].key /var/lib/grommunio-antispam/dkim/[youKey].key

mlowijs

Thanks for your response.
I copied the key as suggested:

mail:/var/lib/grommunio-antispam # ls -l lowijs.io.dkim.key -r--r----- 1 root root 1704 Aug 11 12:58 lowijs.io.dkim.key

and restarted the server, but mails still do not get a DKIM header added to them.

Is there anything else that needs to be done? This is a completely fresh grommunio server.

Steakie

mlowijs needs to also be owned by groas user:

chown groas:grommunio [key].key

chmod 600 [key].key

( i am also using this thread to simultaneously create an improved manual in AWEB )

I was apparently also mistaken about the directory:
Key needs to be at /var/lib/grommunio-antispam/dkim/[domain].dkim.key

mlowijs

Steakie

I moved the key and changed the permissions:

mail:/var/lib/grommunio-antispam/dkim # ls -la total 8 drwxr-x--- 2 groas grommunio 32 Aug 11 14:33 . drwxr-x--- 3 groas grommunio 4096 Aug 11 14:36 .. -rw------- 1 groas grommunio 1704 Aug 11 14:31 lowijs.io.dkim.key

and restarted grommunio-antispam.

However, mails are still not signed. Anything else that needs to be done?

Steakie

mlowijs this is where my own knowledge is a bit limited too...did you configure postfix?

sth like postconf -e 'non_smtpd_milters = inet:localhost:8891' but with the correct domain:path?

mlowijs

No I did not; I kind of expected everything to work out of the box once the keys were generated.

I ran the following command:

postconf -e 'non_smtpd_milters = inet:localhost:11332'

because I saw the smtpd_milters was set to the same value.

Now my outgoing emails are being signed, but my DNS provider is not picking up the new TXT record with the DKIM key. That is an issue on their side probably, and I will check to see if, once the record propagates, the emails are being signed correctly.

One question though; should this setting not be set correctly by out of the box by grommunio?

Steakie

mlowijs we are currently having an internal discussion and plans to automate this process further, but did not find the best possible way to merge already existing environments with upcoming changes yet

Tobias

Let me summarize the steps you need to take on the server:

postconf -e 'non_smtpd_milters = $smtpd_milters'
mkdir /var/lib/grommunio-antispam/dkim
cp /var/lib/grommunio-admin-api/DOMAIN.COM.dkim.key /var/lib/grommunio-antispam/dkim/
chown groas:grommunio /var/lib/grommunio-antispam/dkim/DOMAIN.COM.dkim.key
chmod 600 /var/lib/grommunio-antispam/dkim/DOMAIN.COM.dkim.key
systemctl restart postfix

I verified these steps on a new setup.

Let me know if this works for you as well .

mlowijs

Makes sense! After the TXT record was picked up by my DNS provider, DKIM signing seems to work.

So currently, at least for new installations, the process is:

Generate the key pair from the admin UI;
Copy the private key from /var/lib/grommunio-admin-api/YOURDOMAIN.dkim.key to /var/lib/grommunio-antispam/dkim/YOURDOMAIN.dkim.key
chown -R groas:grommunio /var/lib/grommunio-antispam/dkim
chmod 600 /var/lib/grommunio-antispam/dkim/YOURDOMAIN.dkim.key
postconf -e 'non_smtpd_milters = inet:localhost:11332'
systemctl restart grommunio-antispam

Then setup the public key in your DNS and it should be good to go!

EDIT: haha @Tobias you were just a little faster than me, but that seems to be the right process indeed!

dneuhaeuser

seems as the selector name is currently hardcoded to "dkim" !?
while generating keypair, I entered a custom selector, but rspamd is using "s=dkim" anyway...

Steakie

dneuhaeuser

no it is not

dneuhaeuser

Steakie
until this point it seems ok, but try to send a mail after finishing config.
on 2 installations I see rspamd using s=dkim instead of s=anotherSelector.
then dkim verify fails on recipients side.

WalterH

In /etc/grommunio-antispam/override.d/dkim_signing.conf you find: selector = "dkim";. What happens if you change dkim to anotherSelector and recreate the certificate.

WalterH

BTW, if you do not have the /etc/grommunio-antispam/override.d/dkim_signing.conf file, you find it here including the explanation: https://docs.rspamd.com/modules/dkim_signing/ .

dneuhaeuser

WalterH
thank you.
indeed, on a fresh installation /etc/grommunio-antispam/override.d/dkim_signing.conf does not exist.

so, what I meant was: without additional configuration work, rspamd is always using the selector "dkim", no matter what you enter in GUI while creating keypair.

with your recipe all becomes clear now.

WalterH

Set up DKIM signing for grommunio