ちょっとこの辺にぃ、DKIM設定あるんだけど～焼いてかない～？というわけでPostfixにDKIMを導入してみました。
参考にしたサイトは DKIM+SPFで送信ドメイン認証しちゃおう！ CentOS7+Postfix+OpenDKIM
アリシャス！
yum で行きますよ～イクイク！
# yum install epel-release
# yum install opendkim
# yum install opendkim-tools
鍵を保存するディレクトリを新規作成 ワイルドカード用にショートドメインを指定しました。
# mkdir -p /etc/opendkim/keys/mail.stuffy.site
鍵生成の際に、DKIMレコードに必要なセレクタを -s オプションで指定するのを忘れず、ビット長はUDPのパケットサイズの関係で -b 1024にするとうまく行きました。
# opendkim-genkey -D /etc/opendkim/keys/mail.stuffy.site/ -b 1024 -d stuffy.site -s 20220719
鍵の所有権を変更
# chown opendkim:opendkim -R /etc/opendkim/keys/mail.stuffy.site/
鍵の場所をKeyTableで指定します。
# vi /etc/opendkim/KeyTable
# OPENDKIM KEY TABLE # To use this file, uncomment the #KeyTable option in /etc/opendkim.conf, # then uncomment the following line and replace mail.stuffy.site with your domain # name, then restart OpenDKIM. Additional keys may be added on separate lines. #コ↑コ↓ 20220719._domainkey.mail.stuffy.site mail.stuffy.site:20220719:/etc/opendkim/keys/mail.stuffy.site/20220719.private
続いてSigningTable を設定します。ホスト指定で行きました。
# vi /etc/opendkim/SigningTable
# NON-WILDCARD EXAMPLE
# If "file:" (instead of "refile:") is specified in /etc/opendkim.conf, then
# wildcards will not work. Instead, full user@host is checked first, then simply host,
# then user@.domain (with all superdomains checked in sequence, so "foo.example.com"
# would first check "user@foo.example.com", then "user@.example.com", then "user@.com"),
# then .domain, then user@*, and finally *. See the opendkim.conf(5) man page under
# "SigningTable" for more details.
#コ↑コ↓ *@mail.stuffy.site 20220719._domainkey.mail.stuffy.site
opendkim.conf 設定ファイルのバックアップと編集
# cp /etc/opendkim.conf /etc/opendkim.conf.org # vi /etc/opendkim.conf #Mode v # ← コメントアウト
↓ 変更
Mode sv #KeyFile /etc/opendkim/keys/default.private # ← コメントアウト KeyTable /etc/opendkim/KeyTable # ←チェック外す SigningTable refile:/etc/opendkim/SigningTable # ←チェック外す ExternalIgnoreList refile:/etc/opendkim/TrustedHosts # ←チェック外す InternalHosts refile:/etc/opendkim/TrustedHosts # ←チェック外す
TrustedHostsファイルを新規作成してローカルネットワークを追加します。
# vi /etc/opendkim/TrustedHosts
# OPENDKIM TRUSTED HOSTS
# To use this file, uncomment the #ExternalIgnoreList and/or the #InternalHosts
# option in /etc/opendkim.conf then restart OpenDKIM. Additional hosts
# may be added on separate lines (IP addresses, hostnames, or CIDR ranges).
# The localhost IP (127.0.0.1) should always be the first entry in this file.
127.0.0.1
::1
#host.example.com
192.168.1.0/24
opendkim再起動、自動起動設定、正常起動確認します。
# systemctl restart opendkim
# systemctl enable opendkim
# systemctl status opendkim
Postfixの設定ファイル /etc/postfix/mai.cf の最下行にDKIM設定を入れて postfix 再起動。
# vi /etc/postfix/main.cf
# 最下行に追加
#コ↑コ↓
## DKIM smtpd_milters = inet:127.0.0.1:8891 non_smtpd_milters = $smtpd_milters milter_default_action = accept
# systemctl restart postfix
先ほど作成したDKIMの公開鍵を確認して、どうぞ。
# cat /etc/opendkim/keys/mail.stuffy.site/20220719.txt
（注：サンプル
20220719._domainkey IN TXT ( "v=DKIM1; k=rsa; "
"p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAreddirepood+4Z6j10dJGLLVb+I+pjX7W+vxpJzWo2KAi//cHs87aM0CRdv53vJdk5pTKC9hcP4L+QHAPe3o6lr15zlQ4KYfc4jIF5cgeIzGXmCsLYwC+8T3uD4PvNBcV" ) ; ----- DKIM key 20220719 for stuffy.site
BINDに公開鍵をDKIMレコードとしてコピペしてDNS更新すればDKIM導入・・・完了です。
[root@ns1~]# cd /var/named
[root@ns1 named]# vi stuffy.site
IN MX 10 mail.stuffy.site.
mail IN A 116.58.163.6
#コ↑コ↓ （注：サンプル 20220719._domainkey IN TXT ( "v=DKIM1; k=rsa; " "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAreddirepood+4Z6j10dJGLLVb+I+pjX7W+vxpJzWo2KAi//cHs87aM0CRdv53vJdk5pTKC9hcP4L+QHAPe3o6lr15zlQ4KYfc4jIF5cgeIzGXmCsLYwC+8T3uD4PvNBcV" ) ;
SPF/DKIM/DMARC などのチェックをするサイト で自分のDKIMレコードがチェックできて、いいゾ～これ！
最後に、メールヘッダーをパパパッと確認して終わり！
From - Thu Jul 21 16:51:32 2022
X-Account-Key: account3
X-UIDL: 0000004b61dfc432
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <gusachan3@gmail.com>
X-Original-To: gusachan3@mail.stuffy.site
Delivered-To: gusachan3@mail.stuffy.site
Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=209.85.210.177; helo=mail-pf1-f177.google.com; envelope-from=gusachan3@gmail.com; receiver=gusachan3@mail.stuffy.site
DMARC-Filter: OpenDMARC Filter v1.4.1 mail.stuffy.site 5AE77400E4CE
Authentication-Results: mail.stuffy.site; dmarc=pass (p=none dis=none) header.from=gmail.com
Authentication-Results: mail.stuffy.site; spf=pass smtp.mailfrom=gmail.com
DKIM-Filter: OpenDKIM Filter v2.11.0 mail.stuffy.site 5AE77400E4CE
Authentication-Results: mail.stuffy.site;
dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="QqMbKW8x"</gusachan3@gmail.com>
Received: from mail-pf1-f177.google.com (mail-pf1-f177.google.com [209.85.210.177])
by mail.stuffy.site (Postfix) with ESMTPS id 5AE77400E4CE
for <gusachan3@mail.stuffy.site>; Thu, 21 Jul 2022 16:51:32 +0900 (JST)
Received: by mail-pf1-f177.google.com with SMTP id 17so1092855pfy.0
for <gusachan3@mail.stuffy.site>; Thu, 21 Jul 2022 00:51:31 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20210112;</gusachan3@mail.stuffy.site></gusachan3@mail.stuffy.site>
Delivered-To: gusachan3@gmail.com
Received: by 2002:a92:c909:0:0:0:0:0 with SMTP id t9csp2024360ilp;
Thu, 21 Jul 2022 10:47:06 -0700 (PDT)
X-Google-Smtp-Source: AGRyM1vPLejqsADKyn9A6aGgOe+7XI4rJr80xjZWYPPq4bPNe3+HuR+OyaP/5rlSLYdIhp5NmF23
X-Received: by 2002:a65:590d:0:b0:41a:2b17:b6f8 with SMTP id f13-20020a65590d000000b0041a2b17b6f8mr18863016pgu.143.1658425626623;
Thu, 21 Jul 2022 10:47:06 -0700 (PDT)
ARC-Seal:
ARC-Message-Signature:
ARC-Authentication-Results: i=1; mx.google.com;
spf=pass (google.com: domain of gusachan3@mail.stuffy.site designates 116.58.163.6 as permitted sender) smtp.mailfrom=gusachan3@mail.stuffy.site;
dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=mail.stuffy.site
Return-Path: <gusachan3@mail.stuffy.site>
Received: from mail.stuffy.site (mail.stuffy.site. [116.58.163.6])
by mx.google.com with ESMTPS id r34-20020a635162000000b003fc3e715428si2855874pgl.342.2022.07.21.10.47.06
for <gusachan3@gmail.com>
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Thu, 21 Jul 2022 10:47:06 -0700 (PDT)
Received-SPF: pass (google.com: domain of gusachan3@mail.stuffy.site designates 116.58.163.6 as permitted sender) client-ip=116.58.163.6;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of gusachan3@mail.stuffy.site designates 116.58.163.6 as permitted sender) smtp.mailfrom=gusachan3@mail.stuffy.site;
dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=mail.stuffy.site</gusachan3@gmail.com></gusachan3@mail.stuffy.site>
コピペでスミマセン。センセンシャル