Q: DKIM sig missing from IOS using Server 5 originated messages only

Hi - I've recently done setup of DKIM on my recently installed OS X 10.11.2 + OS X Server 5.0.15 setup. Previously was on Mavericks + Server 3.x but did clean install.

I found website with information for setup of DKIM that I followed — with some slight changes — and it worked straight off.

As you mentioned that you found a different result from an iOS device to a Mac I just tested my iPhone (had done with Mac during setup) and it came out fine.

There is actually a site you can email to and they send you back a very detailed analysis email. Here is the summary they send, this is result from my iPhone test.

The Port25 Solutions, Inc. team

 

==========================================================

Summary of Results

==========================================================

SPF check:          pass

DomainKeys check:   neutral

DKIM check:         pass

Sender-ID check:    pass

SpamAssassin check: ham

Send an email to: check-auth@verifier.port25.com and see what you get back. I can post tutorial of how I did my setup if needed. Would be tomorrow.

Let us know how you go with the test.

I was going to ask you about your email client and server setup because, fundamentally, once this is setup on the server it should be active for all accounts on the server, at the very least all accounts in the email domain (the one setup for DKIM, let's call it example.com for the purposes of the discussion) unless an account was specifically excluded (if that's possible - I did a straight baseline setup so DKIM is active on my whole domain (example.com) and thereby all accounts having an email address of user@example.com.

After your last email, just for completeness, I ran a test of my iPhone connecting to my server from outside my local (home) LAN to send email. I don't know how you have your mail architecture setup but this is mine

I am using split-horizon DNS so for all devices/clients regardless of whether they are in the LAN or connecting remotely via the Internet they use DNS to resolve the (mail) server.

Internally + Externally:

=================

client email --> server.example.com [Postfix/587] --> server.example.com [Amavis/10024] --> server.example.com [Postfix] --> External Mail Forwarder -> Onwards delivery

I am using port 587 / SMTP Submission for client submission of email, on my firewall I have the external public DNS resolved address for MX at server.example.com mapped to the server internal LAN address.

So back to your situation - can you check why/how different client machines are connecting differently to mail running on your OS X Server.app machine. If you are using port 587 for email submission across the board then all email - for the domain you setup DKIM on, the mail domain setup on the mail service of your Server.app - should be being process via the same path.

There is one setting in Amavis which I changed as part of the DKIM setup, don't have the info to hand here, which I will advise when I post my setup. That may have some relevance.

In the meantime if you can check the above on your site.

Good luck!

Setting up DKIM on OS X 10.11.2 and OS X Server 5.0.15

This is based on the information at https://classicyuppie.com/protecting-your-domain-with-spf-and-dkim/, I have expanded and clarified various points.

Working Folder

The standard folder location for mail in Server.app 5.x is:

/Library/Server/Mail

we will be making changes to Amavis in the following folder:

/Library/Server/Mail/Config/amavisd

Even though the commands use the full path to files you may find it helpful to change to that folder.

Create the DKIM private key

Notes:

• This creates a 1024 bit RSA private key, a 2048 length key can be made by appending a space then 2048 at the end of the command. I don't believe a 2048 bit key is strictly necessary.
• The permissions are set to world readable. I don't believe that is desirable, you could try 640 and see how it works.

sudo amavisd genrsa /Library/Server/Mail/Config/amavisd/dkim_key

sudo chmod 644 /Library/Server/Mail/Config/amavisd/dkim_key

Edit the amavisd.conf file

Notes:

• In the website this is shown as one line, I enter as two for readability as they are actually two commands
• This assumes the key file has the name and location as created in the previous commands
• Enter the lines replacing 'example.com' for your Internet legal domain name.

dkim_key('example.com', 'mail', '/Library/Server/Mail/Config/amavisd/dkim_key');

@dkim_signature_options_bysender_maps = ( { '.' => { a => 'rsa-sha256', ttl => 30*24*3600, c => 'relaxed/relaxed' } } );

Change the following line:

$interface_policy{'10026'} = 'ORIGINATING';

to:

$interface_policy{'10024'} = 'MYNETS';

I am not 100% sure of the purpose of this change, I believe it is to change the scope the DKIM function will apply to.

Save the amavisd.conf file and exit your editor.

Generate the Public Key

Run the following command

sudo -u _amavisd -H amavisd -c /Library/Server/Mail/Config/amavisd/amavisd.conf showkeys

which will output the public key for the dkim_key private key you generated earlier. It will look something like this:

; key#1 1024 bits, i=mail, d=example.com, /Library/Server/Mail/Config/amavisd/dkim_key

mail._domainkey.example.com. 3600 TXT (

  "v=DKIM1; p="

  "MIGfMA0GCSqGSIb3BQEBAQUA12345678iQKBgQDczdNsPrmwkI0spKJDEzhWuaEh"

  "MFwB4kIunu0E+yrAbcDeFgHiJkLmNoPQXPdpi0fWyONV0qQuzA3HGMfnsEo5OIO9"

  "vpV69I333333333333444444RtIarnpYlaB2a+5wRGfHlj61YhWdIjGrsh4IUztq"

  "edr3456789BBDDIDAQAB")

Enter the DKIM DNS record

The first line describes the public key — the key length, the domain it is for etc. The second line is a DNS record format line if you were going to import it into BIND, in our case we will (most likely) be entering it into the management screen of our external DNS provider. Each provider will have a different format screen but the values you will enter are assuming the provider auto fills in the domain portion of the DNS record i.e. example.com. The lines of the TXT text value are joined together into one line enclosed in double quotes.

DNS Record Type: TXT

TTL:  3600

Key: mail._domainkey

Text: "v=DKIM1; p=MIGfMA0GCSqGSIb3BQEBAQUA12345678i [....] edr3456789BBDDIDAQAB"

Restart the Amavis daemon

You can either just restart the amavis daemon or restart the whole mail server.

sudo ps aux | grep amavisd | grep master 

sudo kill <PID#>

Test the installation

Send an email to — check-auth@verifier.port25.com — from different clients, Macs & iOS devices, and from your LAN and the Internet. It will send you back a detailed email but what you are looking for is the DKIM check = pass in the summary at the top.

==========================================================

Summary of Results

==========================================================

SPF check:          pass

DomainKeys check:   neutral

DKIM check:         pass

Sender-ID check:    pass

SpamAssassin check: ham

I also have SPF setup on my domain so it shows a pass on SPF check.

Hi

3) I seem to be getting one detail from the checker at port25 that has me confused:  (specifically the message not signed result)

----------------------------------------------------------

DomainKeys check details:

----------------------------------------------------------

Result:         neutral (message not signed)

ID(s) verified: header.From=user@example.com

DNS record(s):

 

yet when I look at my header on gmail, I see my server's email has indeed signed it.  Are you also seeing this?

It's OK, you're good, I see the same on reply to my test email.

----------------------------------------------------------

DomainKeys check details:

----------------------------------------------------------

Result:         neutral (message not signed)

ID(s) verified: header.From=user@example.com

DNS record(s):

This is for DomainKeys, the original (proprietary) system setup by Yahoo which morphed into, and is different to, the open source DKIM. The setup I documented does not include DomainKeys, and really don't believe it's necessary to have both. Obviously DKIM provides the necessary functionality.

If you are seeing the summary results you posted from emailing via multiple client devices inside your LAN and the Internet then you are good to go!

Huh - forum software didn't show my first post, even after multiple refreshes, so I thought it had been trashed, did it again and first one appeared - go figure

It doen not show that the message was signed with DKIM?

Why not? It is only neutral without signature?