Configuring OpenDKIM for Postfix SMTP Server

OpenDKIM is an open-source implementation of the DKIM (DomainKeys Identified Mail) sender authentication system used to verify the authenticity of email messages. By configuring OpenDKIM, we can sign outgoing email messages from our Postfix SMTP server to ensure that they are not spoofed or tampered with.

Here is a step-by-step guide to configuring OpenDKIM for your Postfix SMTP server:

Step 1: Install OpenDKIM To get started, you need to install OpenDKIM and its tools. You can do this by running the following command:

sudo apt install opendkim opendkim-tools

Step 2: Add Postfix User to OpenDKIM Group Next, add the postfix user to the opendkim group so that Postfix can access the OpenDKIM service. You can do this by running the following command:

sudo gpasswd -a postfix opendkim

Step 3: Configure OpenDKIM Main Configuration File Open the OpenDKIM main configuration file using the following command:

sudo nano /etc/opendkim.conf

Find the following line and uncomment it:

Syslog yes

By default, OpenDKIM logs are saved in the /var/log/mail.log file. To generate more detailed logs for debugging, add the following line:

Logwhy yes

Locate the following lines and uncomment them:

#Canonicalization simple 
#Mode sv 
#SubDomains no

Replace “simple” with “relaxed/simple” in the “Canonicalization” line.

Then, add the following lines below the “#ADSPAction continue” line:

AutoRestart yes

AutoRestartRate 10/1M

Background yes

DNSTimeout 5

SignatureAlgorithm rsa-sha256

Finally, add the following lines at the end of the file:

#OpenDKIM user

# Remember to add user postfix to group opendkim

UserID opendkim

# Map domains in From addresses to keys used to sign messages

KeyTable refile:/etc/opendkim/key.table

SigningTable refile:/etc/opendkim/signing.table

# Hosts to ignore when verifying signatures

ExternalIgnoreList /etc/opendkim/trusted.hosts

# A set of internal hosts whose mail should be signed

InternalHosts /etc/opendkim/trusted.hosts

Save and close the file.

Step 4: Restart OpenDKIM and Postfix Finally, restart the OpenDKIM and Postfix services using the following commands:

sudo systemctl restart opendkim

sudo systemctl restart postfix

Now, your Postfix SMTP server is configured to sign outgoing email messages using OpenDKIM. The next time you send an email from your server, OpenDKIM will automatically sign the message to verify its authenticity.