Debian – DKIM header exists but signature is not valid

debiandkimopendkimpostfix

UPDATE

Now the validator at mail-tester.com says the DKIM signature is fine.
On the other hand the isnotspam.com still doesn't seem to like it.
I assume it is working fine now. Also gmail accepts the email.

The change I made:

I changed the
smtpd_tls_cert_file=..
smtpd_tls_key_file=..

to hold the keys for the primary domain. However my VPS contains several domains, so it still remains to be seen what happens with mails from

someone@example2.com

END OF UPDATE

I am getting a DKIM validation error. For your reference you can find the report at the end of this post.

I am confused about what to put in the /etc/postfix/main.cf

smtpd_tls_cert_file=???
smtpd_tls_key_file=???

should these be the certificate of the domain (e.g. example.com)?

Of which these are the most relevant parts:

DomainKeys check details:

Result: neutral (message not signed)
ID(s) verified: header.From=dexter@example.com
Selector=
domain=
DomainKeys DNS Record=

DKIM check details:

Result: fail
ID(s) verified: header.From=dexter@example.com
Selector=201608
domain=example.com
DomainKeys DNS Record=201608._domainkey.example.com

I did double check that the DNS (mxtoolbox) is what I would expect it to be.
My message is getting signed, but for some reason the signature does not match.

I really am running out of options that's why I am knocking on your doors.

I followed the steps outlined here to the letter:
https://www.linode.com/docs/email/postfix/configure-spf-and-dkim-in-postfix-on-debian-8

(A very good tutorial I think. Nevertheless this would also give me another problem:
warning: connect to Milter service local:/opendkim/opendkim.sock: Permission denied, which I worked around by changing
UMask 000
to
UMask 002).

Thanks a lot.
dexter

From the isNOTspam service:

==========================================================

Summary of Results

SPF Check : pass
Sender-ID Check : pass
DomainKeys Check : neutral
DKIM Check : fail

SpamAssassin Check : ham (non-spam)

Details:

HELO hostname: server.example.com
Source IP: 37.97.206.208
mail-from: dexter@example.com

Anonymous To: ins-phz0j2aw@isnotspam.com

SPF check details:

Result: pass
ID(s) verified: smtp.mail=dexter@example.com
DNS record(s):
example.com. 74618 IN TXT "v=spf1 a mx ip4:37.97.206.208 ip6:2a01:7c8:aac3:aa::1/48 ~all"

Sender-ID check details:

Result: pass

ID(s) verified: smtp.mail=dexter@example.com
DNS record(s):
example.com. 74618 IN TXT "v=spf1 a mx ip4:37.97.206.208 ip6:2a01:7c8:aac3:aa::1/48 ~all"

DomainKeys check details:

Result: neutral (message not signed)
ID(s) verified: header.From=dexter@example.com
Selector=
domain=
DomainKeys DNS Record=

DKIM check details:

Result: fail
ID(s) verified: header.From=dexter@example.com
Selector=201608
domain=example.com
DomainKeys DNS Record=201608._domainkey.example.com

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=example.com;
s=201608; t=1470311857;
bh=g3zLYH4xKxcPrHOD18z9YfpQcnk/GaJedfustWU5uGs=;
h=To:Subject:Date:From:From;
b=Xy3uCw55frNys0VUaYiEDRxnCB0uoO9JWuXwtQYM1n6uqyNenv7EL5RTFAxjABeiL
jlfOlSN8r4HPpaKvmWff8wYyEpCvU++t67n+uoCwRixYZRG0x62wuLtFXOJc5dI5o4
EJkFvKTXuj49v/pDxPk4RYwgXmBSCcFiSY3g5YzxM3TIByBi78/6fuIo0NWHXGrBHK
m+FwiB512yyETI4r/qK+VpqNVZtHKoZlYxrWSlPSTZZDKK0j7asR/yBqiA/UDqkqgt
uSHiROnxVuhzcOqd5SVzbP0G+VjpkrP/iEdgtYVBV6+t9YhDSncZX0umAn4hPqGfyo
4GPz7s/Sf/Qbw==

Best Answer

Now the validator at mail-tester.com says the DKIM signature is fine. On the other hand the isnotspam.com still doesn't seem to like it. I assume it is working fine now. Also gmail accepts the email.

The change I made:

I changed the smtpd_tls_cert_file=.. smtpd_tls_key_file=..

to hold the keys for the primary domain. However my VPS contains several domains, so it still remains to be seen what happens with mails from

someone@example2.com

First the postfix SSL certs have absolutely nothing to do with DKIM so that was different issue you had.

Second if you still are getting errors at isnotspam.com then don't assume everything is alright until you get a green light on all tests.

Third create new signatures for each domain and make sure the DNS entry is correct as well as permissions on the signature files.

Also make sure your postfix/main.cf has the proper entries and the .sock actually exists.

    # DKIM / SPF
# --------------------------------------
milter_default_action = accept
milter_protocol = 6
smtpd_milters = unix:/var/run/opendkim/opendkim.sock
non_smtpd_milters = $smtpd_milters

Check mail logs for errors, warnings after restart opendkim, should look something like this:

Feb 21 17:18:23 serverdcu opendkim[2078]: OpenDKIM Filter: mi_stop=1
Feb 21 17:18:23 serverdcu opendkim[2078]: OpenDKIM Filter v2.11.0 terminating with status 0, errno = 0
Feb 21 17:18:23 serverdcu opendkim[37449]: OpenDKIM Filter v2.11.0 starting (args: -P /var/run/opendkim/opendkim.pid -p local:/var/run/opendkim/opendkim.sock)

Related Solutions

Emails are going to spam

The following is based off of the IP I see in your logs as the mail sending IP of 67.55.9.182.

You have a PTR entry, which is good.

;; ANSWER SECTION:
182.9.55.67.in-addr.arpa. 14400 IN      PTR     dsl-67-55-9-182.acanac.net.

However your forward and reverse should match ideally. The reverse entry leads me to believe that you are running this off of a DSL ISP connection. That is enough to get your mail marked as spam in some systems. They do not like seeing mail coming from "home" or "consumer" connections.

Your IP is also listed in several blacklists:

67.55.9.182 is listed in dnsbl-3.uceprotect.net 
67.55.9.182 is listed in bl.spamcannibal.org

This will also result in your mail being sent to the spam bin.

Resolve the above issues and you will likely see your mail being accepted as ham. Hope that helps and let me know if you have any questions.

Valid DKIM signature ramdomly fails to validate

While my DKIM record is "valid", some validators won't accept h=rsa-sha256; argument in a DNS record and will render the DKIM signature as invalid. I imagine that Google is using a few diffrent linux distros in their mail servers with diffrent validators.

To solve this issue just remove that argument on your DKIM record it should look like this:

v=DKIM1; k=rsa; s=email; p=MI...

After this every single email will get properly validated.

I crossed across http://dkimvalidator.com while doing some research and it was the only tool that yield a rather confusing message:

result = invalid
Details: public key: does not support hash algorithm 'sha256'

Surprisingly this error seems to be unusual but when you use opendkim to generate your keys you might find yourself doing something like this:

opendkim-genkey -b 2048 -h rsa-sha256 -r -s customselector -d domain.com -v

Which writes the incorrect argument into the txt output file resulting in a invalid DKIM record.

UPDATE

END OF UPDATE

Of which these are the most relevant parts:

DomainKeys check details:

DKIM check details:

Summary of Results

SpamAssassin Check : ham (non-spam)

Details:

Anonymous To: ins-phz0j2aw@isnotspam.com

SPF check details:

Sender-ID check details:

DomainKeys check details:

DKIM check details:

Best Answer

Related Solutions

Emails are going to spam

Valid DKIM signature ramdomly fails to validate

Related Topic