Email sent via a smarthost are not signed: Tainted filename '/var/cpanel/domain_keys/private/domain.tld'

Symptoms

With an email smarthost enabled, messages are not being signed with DKIM. The Exim error log /var/log/exim_mainlog will have errors similar to the following:

CONFIG_TEXT: unable to open file for reading: /var/cpanel/domain_keys/private/example.tld
Tainted filename '/var/cpanel/domain_keys/private/example.tld'

This can affect smarthosts such as MailChannels and SpamExperts.

Cause

Older versions of Exim used $sender_address_domain in the configuration. In version 4.94 and above this needs to be updated to use ${perl{get_dkim_domain}} in order to use untainted data.

Resolution

1. Navigate to Home / Service Configuration / Exim Configuration Manager in WHM.
2. Navigate to the Advanced Editor tab.
3. In the TRANSPORTSTART section update the dkim_domain value to the following:

CONFIG_TEXT: dkim_domain = ${perl{get_dkim_domain}}

Additional Information:

How to configure a third-party smarthost for your cPanel server