Skip to main content

Signing email with exim and dkim

Pascal Pharand
Hi everyone, I seem to have a problem signing outgoing emails with dkim. I have created an account and activated the dkim and spf. I have updated my domain DNS with both but I cannot get dkim to work. If send email with wordpress or for example horde, exim does not sign the emails. Hotmail and the others all say that dkim=none. The spf pointer on the other hand seems to be working properly and pass validation. Note that the server from which I manage that account is not the main DNS server. Is there anything special I need to do ? CENTOS 6.8 x86_64 standard WHM 60.0 (Build 4) Host : iWeb Any help would be appreciated.

Comments

19 comments

Date Votes
  • Infopro
    Do you see any issues with the domain when checking it with a site like intodns.com?
    0
  • Pascal Pharand
    Doesn't seem to be any errors. Some warning : Different subnets WARNING: Not all of your nameservers are in different subnets Different autonomous systems WARNING: Single point of failure SOA EXPIRE Your SOA EXPIRE number is: 3600000. That is NOT OK Otherwise everything else as a green checkmark.
    0
  • Infopro
    I have created an account and activated the dkim and spf. I have updated my domain DNS with both but I cannot get dkim to work.

    Silly question I suppose, but is this the order you did things exactly? Seems backwards so I'm asking.
    0
  • Pascal Pharand
    Yes this is the order I used if I remember well. I created the account, activated the dkim and spf and then updated the dns records. If I use Tools - mail-tester.com everything checks out. I get the spf pointer and the dkim public key. I have also checked the /var/cpanel/domain_keys/public/mydomain public keys are matching as well.
    0
  • Infopro
    How long ago did you make the changes? Might it be that your DNS changes need to propagate?
    0
  • Pascal Pharand
    last friday. Dns should have propagated by now. The dkim does not even fail exim just doesn't sign the emails at all. anyway what i'm playing with right now is a subdomain. for example my main domain is example.ca and the subdomain is portailclinique.example.ca. Since it is not signing i'll try to restart from the beginning. Backup my data and db and recreate the account from zero. I might have missed something while setting up the account or improperly setted it up.
    0
  • Infopro
    Not sure if redoing everything is of any use here. From mxtoolbox: Your Reverse DNS Record (PTR) is not a valid host name. According to email sending best practices, a PTR Record should be a valid host name. If the PTR Record is not a valid hostname, there is a likelihood that you will experience email delivery issues with anti-spam services.
    0
  • Pascal Pharand
    Yes basically it didn't help at the moment. I recreated the account and used the new dkim generated but exim doesn't sign the emails. I'll take a look at the reverse pointer.
    0
  • Infopro
    These docs may be of some use to you: kb.iweb.com/entries/22038828-Configuring-Reverse-DNS-Control-Center-or-Customer-Hub-
    0
  • Pascal Pharand
    Yes the dns where properly working in the DNS zone but neither hotmail nor gmail see any dkim signature. Google passes dmarc and spf record. Hotmail tells me that spf passes but both gives me dkim=none. As if the signature was not added by exim for some reason.
    0
  • Pascal Pharand
    * meant reverse dns pointer.
    0
  • Infopro
    Hotmail tells me that spf passes but both gives me dkim=none.

    Not sure if this is of any use, but are you testing hotmail using a blank email? answers.microsoft.com/en-us/outlook_com/forum/oemail-osend/hotmail-deems-my-business-emails-as-dkimfail-all/ad2e7d37-4a1e-4bd4-b8d0-c5ad76d82d52 A few days later after the initial implementation of DKIM and the results above (of on MS servers giving a DKIM-FAIL), I did further tests. Microsoft servers give DKIM=FAIL if the BODY of your text is blank - if the body is not blank (which is normally the case in most emails) then they also gave DKIM=PASS. This was true for both plain text and html/richtext email bodies. (My initial test emails just contained recipient address and a subject (eg "test 1") and didnt have a body text.). Phew. Wierd (because I dont think its correct and it certainly doesnt behave like other do), but phew!
    0
  • Pascal Pharand
    No i'm using wordpress to send messages by creating a user with my email. The message is not blank it has a subject and a body with some links. It does not fail dkim it just gives me dkim=none : CMM-Authentication-Results: hotmail.com; spf=pass (sender IP is 0.0.0.0; identity alignment result is pass and alignment mode is relaxed) smtp.mailfrom=myuser@majeur.example.ca; dkim=none (identity alignment result is pass and alignment mode is relaxed) header.d=portailclinique.example.ca; x-hmca=pass header.id=wordpress@portailclinique.myexample.ca
    0
  • Infopro
    So, you're using the SMTP setup in wordpress with a proper email account's credentials? Does it work if you use the main domain instead of the sub.domain?
    0
  • Pascal Pharand
    No smtp setup. Just using sendmail by default.
    0
  • Pascal Pharand
    ok that's new... squirrelmail just signed the email with dkim and it passed... that's odd and mail sent by wordpress does not.
    0
  • Pascal Pharand
    I`ve configured Wordpress to use smtp instead of sendmail. I was finally able to sign the emails with the proper dkim signature. Although the signature needs specifically coming from a particular email address.
    0
  • Pascal Pharand
    Thanks for your help. I`ve been able to sign my emails properly.
    0
  • Infopro
    Happy to hear you got it going. :)
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post