-
- Getting Started
- Git and File-System Layout (non-default setup)
- Version Constraints
- Managing Themes and Plugins (for entire WordPress site)
- Updating Themes and Plugins (for entire WordPress site)
- Adding Composer Support to Your Own Themes and Plugins (for developers)
- Using Composer to Manage Own Theme/Plugin Dependencies (for developers)
-
- Assigning Multiple IP Addresses to Single LAN Card
- Disable IPv6 on Ubuntu 12.04
- dsh – distributed shell
- fdupes – find & replace duplicate files with hardlinks
- GPG Keys Cheatsheet
- Increase "Open Files Limit"
- kill all php, nginx, mysql or any kind of processes
- Passwordless Authentication for SSH
- Screen
- search replace in multiple files useing grep xargs sed
- Setup sftp
- sysctl.conf
- Timezone Sync
- Using Google Public DNS on Ubuntu Server
- Using openssl to match private key, cerificate and CSR
- Configure Postfix to Use Gmail SMTP on Ubuntu
- Logrotate Example for Custom Logs
- PHP 5.5, MySQL, Postfix, Nginx and WordPress on Ubuntu
- Serverdensity
- Upgrade Ubuntu 10.04 to 12.04
- Using find and sed to replace strings in multiple files
- Webmin
-
- .my.cnf – mysql user & password
- Analyse slow-query-log using Anemometer
- Improving MySQL Query Cache
- MySQL Query Profiling
- Reset MySQL root password
- tuning-primer.sh – an alternative for mysqltuner
- Using MariaDB 10
- Install/Upgrade to MySQL 5.6 on Ubuntu 12.04 LTS
- Change WordPress Domain Name
- Character Sets and Collations
- Enable innodb_file_per_table
- Enable Remote Access (Grant)
- Installing Percona Toolkit
- Using tmpfs for temporary folder creation
- YARPP and InnoDB
- Convert MyISAM to InnoDB
- Using tmpfs for mysqldump & mysqlimport
- Convert from INNODB to MYISAM
- Analyse slow-query-log using mysqldumpslow & pt-query-digest
- mysqlcheck with cron to optimize automatically
- Using MySQLTuner to Optimize MySQL configuration
-
- Checking FQDN, Reverse-DNS/PTR, MX record
- Clients
- DKIM with Postfix
- Postfix Queue Management
- RoundCube
- Server Setup
- Setup OpenDKIM
- SPF Records
- swaks – SMTP test tool
- Using larch for mail transfer between imap/gmail servers
- Debugging Postfix Config, Mail Logs & more
- Increasing Attachment Size in Posfix
-
- Adding $upstream_cache_status in HTTP Response Headers
- Amazon Elastic Load Balancer and Forwarding Real-IP Nginx
- Block wp-login.php bruteforce attack
- Configuring HTTP/2 Server Push
- Enable gzip compression
- fail2ban
- Let's Encrypt with EasyEngine
- Nginx's Open file cache
- Serving fonts with correct mime types
- SSL – PCI compliance and performance optimization
- Troubleshooting
- Tweaking fastcgi-buffers
- Using $upstream_cache_status in access.log
- Using Pagespeed
- Weak Diffie Hellman Logjam Attack Fix
- Website access restriction using nginx
- Enable Nginx Status Page
- Forwarding Visitor's Real-IP + Nginx Proxy/Fastcgi backend correctly
- Parsing access.log and error.logs using linux commands
- Debugging Nginx Configuration
- Nginx config for www to non-www and non-www to www redirection
- Optimizing Nginx Configuration
- Rewrite Rules for vBulletin SEO-friendly permalinks
-
- Directly connect to PHP-FPM
- Generating core-dump for php5-fpm
- GeoIP
- Having php5 and php7 on same system.
- Install Xdebug and configure it with webgrind
- Installation of PHP Code Review Tools
- memcache
- PHP's Zend Opcache Config & Web Viewer
- Setting Sqlite support with PHP
- Using HHVM with PHP-FPM Fallback
- Using Redis for PHP Sessions on Ubuntu Server
- Installing PhpMyAdmin Quickly
- Moving PHP's session storage to tmpfs
- Install Xdebug and configure it with Netbeans
- Nginx – Enable PHP-FPM Status Page
- PHP-FPM: Socket vs TCP/IP and sysctl tweaking
- APC Cache Optimization & Monitoring Using Web Interface
- Checking if PHP/WordPress can send mails
- Debugging PHP Scripts Using slow_log and more
- Increase file upload size limit in PHP-Nginx
- Increase PHP script execution time with Nginx
-
- Performance Optimization
- Remove Query string of css/js files
- Setup ElasticSearch with ElasticPress
- Using Redis for WordPress Object-Cache
- WooCommerce Window Shopping Caching Technique
- Moving WordPress To New Server (Faster)
- Better wp-cron using linux's crontab
- 404 error- Page not Found!!!
- Debugging WordPress with Nginx
Last updated on Dec 18, 2020
If mails from your web-server/webapp is having delivery issues, DKIM (DomainKeys Identified Mail) can help you big time.
Its highly recommended to use DKIM for outgoing emails even if your server is not running any kind of mail-hosting.
Install DKIM
apt-get install opendkim opendkim-tools
Edit Config files
DKIM config
Open dkim config file vim /etc/opendkim.conf
Add following lines towards end. Make sure you replace example.com with your domain/subdomain.
Domain example.com
KeyFile /etc/postfix/dkim.key
Selector mail
SOCKET inet:8891@localhost
Next open dkim defaults file vim /etc/default/opendkim
Change default socket path by adding a line like below:
SOCKET="inet:8891@localhost"
Postfix file
Open postfix main config file vim /etc/postfix/main.cf
Add following lines towards end.
# DKIM
milter_default_action = accept
milter_protocol = 2
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891
DKIM Key Generation
Run following commands with mail and example.com matching values used in /etc/opendkim.conf file in earlier step.
opendkim-genkey -t -s mail -d example.com
This command will generate mail.private and mail.txt file. mail.private is private key that will be used to sign outgoing emails. Move it to the location we specified earlier in /etc/opendkim.conf
cp mail.private /etc/postfix/dkim.key
DNS Record Setup
Next, you need to create a TXT record on DNS end. Just check content of mail.txt file created by opendkim-genkey command we ran above.
cat mail.txt
You will see something like below:
mail._domainkey IN TXT "v=DKIM1; k=rsa; t=y; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDYv84GSl0Xp2CrPdFqMZ9ShBDi9Pal9XpfIf7asEENxLRdIka3TONpqtrcCKksROJBNh2G3OVGuoGJ1watQGT46B+zQtjcCI67+WiTlb2D98s1UV3KO7oi/0QH/lH8DzUmrGJUIy3ZBQ9mIu1t6YDyi8y3hlhTILHW7G4HV/VtwQIDAQAB" ; ----- DKIM key mail for example.com
TXT record will require NAMS & VALUE.
Use mail._domainkey for NAME and long string in quotes starting from v=DKIM1 as VALUE.
Below is a sample screenshot for a TXT record. User-interface on your end might differ.
If you are editing a previous DNS record, it might take sometime for changes to propogate.
Start Signing
Once al config & setup done, you need to start DKIM service and restart postfix.
service opendkim start
service postfix restart
Testing DKIM setup for correctness
Anything we do, specially for first time, must end with successful testing!
There are many tools for testing. I will mention few of them below.
Verify DNS Records for DKIM Setup
This will ONLY verify if your TXT record is created successfully.
dig command
Classic and easy. You must be having this already. Running…
dig mail._domainkey.example.com TXT
should return a response like…
;; ANSWER SECTION:
mail._domainkey.exmaple.com. 86400 IN TXT "v=DKIM1\;" "k=rsa\;" "t=y\;" "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDYv84GSl0Xp2CrPdFqMZ9ShBDi9Pal9XpfIf7asEENxLRdIka3TONpqtrcCKksROJBNh2G3OVGuoGJ1watQGT46B+zQtjcCI67+WiTlb2D98s1UV3KO7oi/0QH/lH8DzUmrGJUIy3ZBQ9mIu1t6YDyi8y3hlhTILHW7G4HV/VtwQIDAQAB"
Web-based Record Check
You can use http://www.protodave.com/tools/dkim-key-checker/
Use selector mail and domain example.com there.
Verify DKIM Signing
Test #1 – Email-based
If you have setup keys correctly then you should pass this test.
You can test by simply sending an email to [email protected] or [email protected]
It’s better to use swaks tools for mail-testing (apt-get install swaks).
swaks -t check-auth2@verifier.port25.com -f me@example.com
Replace [email protected] with your mail id where you would like to receive test results.
Test #2 – Web-based
Better choice will be to use a service like http://www.mail-tester.com/ which gives you a temporary email ID and web-interface to see what happens to the email on receiving end!
For WordPress, its better to test using Check Email plugin as you will get better picture of what happens to mail sent from WordPress!
Comments
Good day
I used
Domain *
KeyFile /etc/postfix/dkim.key
Selector mail
in /etc/opendkim.conf to use the same key for multiple domains
https://help.ubuntu.com/community/Postfix/DKIM#Common_errors_and_fixes
and added “no_milters” to /etc/postfix/master.cf
made this line:
-o receive_override_options=no_header_body_checks,no_unknown_recipient_checks
look like:
-o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
This prevented opendkim signing messages twice.
I am curious whether this is sane or not. Remember laziness counts!
Enjoy your day and thank you for your time.
I never used DKIM like above but in another use-case, I used no_milter to avoid double processing.
If it’s working, it must be fine! 😉
Thanks so much. I was stuck with other tutorials at entering the Information into DNS.
Helped me great!!
Hello,
thank you for this usefull tutorial 😀
i used to create my DKIM
in http://www.protodave.com/tools/dkim-key-checker/ with selector mail is passed ok!
but in the http://www.mail-tester.com/ web site i have always (-1) for this.
i have to use selector named default?
or change something else in settings?
thank you 🙂
You need to make sure selector and DNS TXT name match. If there is a mismatch above testing tool may throw error.
Hi there! I followed your setup to the letter and I am no longer able to send mails. I get a transport error on the Milter serve. Have you got any idea why?
“postfix/cleanup[3127]: warning: invalid transport name: “inet in Milter service: “inet:localhost:8891″”
Check if your postfix config matches – https://rtcamp.com/tutorials/mail/dkim-postfix-ubuntu/#postfix-file ?
Ok So I reset all the config and now it’s working. However, I have another blockage: when I do a HELO test via smtp on the server side (i.e. telnet localhost 25) I can send mails. However, I added my distant application site to mynetworks in order to allow smtp relays. The problem is that the HELO test seems to go well and the message is queued, but the server does nothing. The log file gives no error message either… Any idea?
For HELO issue, please check postfix error log.
t=y in DKIM Key enables test mode, so even if you have DKIM, you are telling it to ignore. Also you can see the mails, you’ll get test mode in it. (when you click show original, it displays dkim =pass (test mode) ).
Ref; http://goo.gl/j3Fjbp, http://goo.gl/sbSI82
Very usrful info! Thanks for sharing. 🙂