DKIM not signing with alias addresses – not internal, not authenticated

aliasdkimgmailopendkimpostfix

I have postfix, dovecot, opendkim and postsrsd installed. I am trying to forward mail from alias@example.com to myemail@gmail.com, and have them signed with DKIM.

I use postsrsd in order for the SPF record to pass for the forwarded emails.

However, when I send an email from my icloud account to alias@example.com, the message is delivered to my gmail inbox, but it is not being signed by DKIM.

Here is an output of my log:

postfix/smtpd:      connect from st11p01im-asmtp001.me.com[17.172.204.151]
postfix/smtpd:      BC23640B53: client=st11p01im-asmtp001.me.com[17.172.204.151]
postsrsd:           srs_forward: <myicloudemail@icloud.com> rewritten as <SRS0=zgyz=HT=icloud.com=myicloudemail@hostname.myemailserver.com>
postfix/cleanup:    BC23640B53: message-id=<6fd8e885-4be1-4a37-983f-3d6f18f3b73a@me.com>
opendkim:           BC23640B53: st11p01im-asmtp001.me.com [17.172.204.151] not internal
opendkim:           BC23640B53: not authenticated
opendkim:           BC23640B53: no signature data

I have looked at http://seasonofcode.com/posts/setting-up-dkim-and-srs-in-postfix.html and all my configuration files appear to be correct.

From what I have seen online, the "not internal, not authenticated" message means that the domain is not present in /etc/opendkim/TrustedHosts, but the domain being listed in the logs (st11p01im-asmtp001.me.com) is not my domain. I believe me.com belongs to Apple.

Is DKIM signing with an alias address using SRS not possible?

Update:

Having disabled postsrsd in /etc/postfix/main.cf, the problem still persists. Therefore, the issue is not with postsrsd, but with opendkim not signing mail for aliases addresses.

I think this is because opendkim looks at the original hostname that send the mail, which in my case is st11p01im-asmtp001.me.com, and therefore does not sign it because this address is not listed in /etc/opendkim/TrustedHosts.

Is there any way to get opendkim to work with alias addresses?

Best Answer

For your concept here the ideal workflow

  1. External email receive by postfix
  2. OpenDKIM verifies the DKIM signature, if exists
  3. Postfix rewrite From: header so it comes from your domain that you controlled, for example example.com
  4. OpenDKIM re-sign DKIM into rewritten email (and remove the original DKIM signature if exists).
  5. Postfix deliver it into aliases address.

Unfortunately, postfix and OpenDKIM doesn't support DKIM signing right before sending to final destination. OpenDKIM only support milter interface that only operates when postfix receives email. Yes, you can have workaround like postfix multi instance so the first instance will do rewriting and the second one will do signing, but I think it's not worth in your case.

Related Topic