Debian – How to test the DKIM configuration of the server (Postfix + OpenDKIM)

debiandkimemailopendkimpostfix

I configured my server (Debian Jessie) and domain with DKIM. I installed OpenDKIM on my server, and followed this tutorial. I went to my domain provider, and set a new DNS TXT record for mail._domainkey.example.com:

"v=DKIM1; k=rsa; p=ThePublicKey"`

Where I got the key from mail.txt, which was generated by the command:

opendkim-genkey -s mail -d example.com

I made sure that the OpenDKIM server is working, and that Postfix is signing the messages. However, I'm unable to find an unbiased way to check whether the emails sent from my server are signed properly.

By googling, I found this service, which gets me to send an email to it, and gives me a report on whether the signing is correct. However, it keeps saying that the signature is invalid in the end report:

SpamAssassin Score: 1.179
Message is NOT marked as spam
Points breakdown: 
 0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was blocked.
                            See
                            http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                             for more information.
                            [URIs: example.com]
 0.0 HTML_MESSAGE           BODY: HTML included in message
 0.3 HTML_IMAGE_ONLY_04     BODY: HTML: images with 0-400 bytes of words
 0.7 MPART_ALT_DIFF         BODY: HTML and text parts are different
 0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily valid
 0.0 TVD_SPACE_RATIO        No description available.
 0.0 T_DKIM_INVALID         DKIM-Signature header exists but is not valid

Although it says in another part (at the DKIM Information, above that report) that it's valid. It says exacly:

Validating Signature

result = pass

While in mxtoolbox, it doesn't show that I have any syntax problem in my DNS entry. It's able to parse the public key without problems.

What can I do to find the problem with my DKIM setup?

Best Answer

Apparently the test at the site I linked has a problem, so, I found two ways to test my config (SSL, SPF, DKIM and DMARC):

  1. Using gmail. Simply send an email to some account of yours in gmail, and check the header of the message. Gmail has a section where it says if tests are passed.

  2. You can use port25. There's an email address there. Send it an email, and it'll reply with a report indicating whether your config is OK .

Related Topic