Postfix/rspamd DKIM signing

[mimugmail]

If there is an easy to use example, maybe

[biricon]

i check the setup file and correct the format for multi-domains - but i dont get any dkim signed mails out of the opnsense.
Is there any changes since this solution was posted?

[biricon]

Hi, i have configured it with the setup script and get this config file with modification of the domains for correct syntax. But the mails will not be signed. i make restarts of the servers, reboot the opnsense, but nothing works. here is my config file:

Code Select Expand

root@sense:/usr/local/etc/rspamd/local.d # cat dkim_signing.conf
enabled = true;
allow_envfrom_empty = true;
allow_hdrfrom_mismatch = true;
allow_hdrfrom_multiple = false;
allow_username_mismatch = true;
auth_only = false;
selector = "dkim";
sign_local = true;
symbol = "DKIM_SIGNED";
try_fallback = false;
use_domain = "header";
use_esld = true;
use_redis = true;
key_prefix = "DKIM_KEYS";
path = "/root/dkim/$domain.key";

domain { xxxx.eu      { selector = 'selector2'; },
         xxxx.at      { selector = 'selector2'; },
         xxxx.eu     { selector = 'selector2'; },
         xxxx.at { selector = 'selector2'; },
         xxxx.com { selector = 'selector2'; }
        }


did anyone have a hint for me?

[opns3nse]

Hi. Since topic is the first result in google, here is my minimalistic step-by-step guide.
Done and tested on 25.7.4.

1. install os-rspamd

2. create folder for dkim key
mkdir usr/local/etc/rspamd/dkim

3. create key
rspamadm dkim_keygen -b 2048 -s email -d yourdomain.com -k /usr/local/etc/rspamd/dkim/email.key /usr/local/etc/rspamd/dkim/email.txt

4. edit owner and acl
chown rspamd /usr/local/etc/rspamd/dkim/email.key
chown 640 /usr/local/etc/rspamd/dkim/email.key

5. disable clamav module
nano /usr/local/etc/rspamd/override.d/antivirus.conf
enabled = false;

6. enable dkim
nano /usr/local/etc/rspamd/override.d/dkim_signing.conf
enabled = true;
sign_local = true; #send from known hosts and networks
sign_inbound = false;
auth_only = false; #send only from authenticated users
use_domain = "header";
allow_hdrfrom_mismatch = false;
allow_username_mismatch = false;

domain {
  yourdomain.com {
    selector = "email";
    path = "/usr/local/etc/rspamd/dkim/email.key";
  }
}

7. test syntax
rspamadm configtest

8. enable plugin and enable antispam in postfix

9. restart both

10. add dns record from /usr/local/etc/rspamd/dkim/email.txt

11. send email and check its properties

?????

DKIM=Pass

[putt1ck]

As per previous poster, seems best to have an answer here as the most relevant result that turns up on <enter preferred search engine here>.

Following steps as above fails initially on rspamadm dkim_keygen with error "Too many options". While rspamdadm documentation (at time of writing) states the comamnd will produce two files, as indicated above, actually it produces only the the key file, outputting the txt (DNS entry) content to stdout. To get it to a shell add a redirect into the example command before the email.txt path. There are also typos in the previously posted instructions, and it doesn't cover the scenario of sending from subdomains, so will reproduce tested working version (OPNsense 26.1) below.

1. Install os-rspamd via web UI (if you already have it installed, disable it for now)

2. enable ssh and sudo as needed, access csh with root powers

3. Create folder for DKIM key

Code Select Expand

mkdir usr/local/etc/rspamd/dkim
4. Generate key

Code Select Expand

rspamadm dkim_keygen -d sub.yourdomain.tld -s email -k /usr/local/etc/rspamd/dkim/email.key -b 2048 > /usr/local/etc/rspamd/dkim/email.txt
5. Set proper owner and ACL for key file

Code Select Expand

chown rspamd:rspamd /usr/local/etc/rspamd/dkim/email.key
chmod 600 /usr/local/etc/rspamd/dkim/email.key
6. Disable clamav module (not sure this is required, but getting it working took so much trouble shooting that we made this change (and clamav should be called by postfix anyway?)

Code Select Expand

vi /usr/local/etc/rspamd/override.d/antivirus.conf

Code Select Expand

enabled = false;
7. Enable DKIM signing by creating the override file with the necessary settings

Code Select Expand

vi /usr/local/etc/rspamd/override.d/dkim_signing.conf

Code Select Expand

enabled = true;
sign_local = true; #send from known hosts and networks
auth_only = false; #send only from authenticated users
use_domain = envelope; #setting to from also worked for us but left at envelope in production
allow_hdrfrom_mismatch = false;
allow_username_mismatch = false;
use_esld = false; #needed if you are using a subdomain to send mail direct from a service e.g. nextcloud.example.com - esld will assume only the latter 2 parts are relevant and look for a domain that matches example.com and fail
use_redis = false; #in our case the keys were not loading to redis but rspamd dkim_signing module was treating it as the "source of truth" and failing to find the key

domain {
   sub.yourdomain.tld {
    selector = "email";
    path = "/usr/local/etc/rspamd/dkim/email.key";
     }
}
8. Test syntax and restart rspamd

Code Select Expand

rspamadm configtest

Code Select Expand

service rspamd restart
9. In web UI enable rspamd plugin and enable antispam in postfix

10. Test DKIM signing from CLI
Create a simple test email where the from address domain part has to match whatever you've used in the steps above

Code Select Expand

vi testmail.eml with content

Code Select Expand

From: john.doe@sub.yourdomain.tld
To: jim.doe@example.com
Subject: Test DKIM Signing

This is a test email for DKIM signing.
Then run

Code Select Expand

rspamc --pass-all -vvvv -i 10.0.3.10 -d jim.doe@example.com -F john.doe@sub.yourdomain.tld < testmail.emlIf signing is working properly then the response should include something like

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sub.yourdomain.tld;
        s=email; t=1784209642; h=from:from:reply-to:subject:subject:to:to:cc;
        bh=RYXvt0hMSt1DiETNsCX712grsTrzBedJQa3fPCnNtAO4=;
        b=bjKtJoFa31oH8afOzkrN+0Thoh84RyvokrSMdr+hcjtJ+aRdDlxR9ZoA

If at this stage you don't get DKIM signing, you can enable rspamd debug logs on a per module basis

Code Select Expand

vi /usr/local/etc/rspamd/logging.inc appending the line

Code Select Expand

debug_modules = ["dkim_signing"]; then restart rspamd and try the test again. Log is in /var/logs/rspamd/rspamd.log.

11. With a successful local test move to add the DNS TXT record for the appropriate (sub.) domain, using the content of the email.txt file you created earlier

Code Select Expand

cat /usr/local/etc/rspamd/dkim/email.txt. Some DNS services will require you to remove some or all of the " "'s used to split the record before letting you add it.

12. Now send a real email using your OPNsense mail relay, the key will be added and the mail should be delivered (to even that big mail provider who tries not to accept emails from small mail providers).

NB this was done on a server going into production so we may have done some steps during troubleshooting that we've overlooked in this write-up. Should get to test it on another project soon and will amend as needed.

Hope it helps someone, be nice to get added to rspamd plugin...