Setting up DKIM for Exim on Debian

Question

Accepted Answer

DKIM (DomainKeys Identified Mail) is an e-mail authentication mechanism that helps fight email forgery. It adds a digital signature to outgoing messages, and the recipient can check the domain's DNS record that the message was indeed sent from the specified domain and that its content was not modified during delivery. On a VPS or dedicated server, DKIM is quite easy to set up because you have full control over the mail server and its configuration. In the example below, we configure DKIM for the domain example.com Create a directory for DKIM keys First, let's prepare the directory where the private key will be stored: mkdir -p /etc/exim4/dkim Generating private and public keys Let's go to the created directory: cd /etc/exim4/dkim Generate a private key (it remains only on the server): openssl genrsa -out example.com.key 1024 Next, based on the private key, we create a public key, which we then add to DNS: openssl rsa -pubout -in example.com.key -out example.com.pub Setting the file owner Exim on Debian usually runs from the user Debian-exim, so we change the owner of the directory and keys: chown -R Debian-exim:Debian-exim /etc/exim4/dkim Connect DKIM in the Exim configuration Open the Exim configuration template: main file: /etc/exim4/exim4.conf.template We add the following parameters before the section remote_smtp: DKIM_CANON = relaxed DKIM_DOMAIN = example.com DKIM_PRIVATE_KEY = /etc/exim4/dkim/example.com.key DKIM_SELECTOR = email If you are using split configuration (conf.d) then these lines should be added to the file: /etc/exim4/conf.d/transport/30_exim4-config_remote_smtp Restart Exim and check the parameters Applying changes: service exim4 restart We check that the DKIM parameters have been picked up: exim -bP transports | grep dkim Adding a DKIM record to DNS Now you need to create a TXT record in the DNS zone of the domain. The record name is formed as follows: email._domainkey Where email is the selector (DKIM_SELECTOR) from the Exim configuration. We insert the public key in DKIM format into the value of the TXT record, for example: v=DKIM1; h=sha256; k=rsa; p=0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDcbu6mvGWmF65Suqazr3Krb2Ky/EXs8qaT1yMDfc00YJD77dq6jCnAwxQUHHuKanl ELGd1uqomTzs5MBuzw0TCEhzIyyiD+ZZBbJQa85a7OhdLoDs7MkwlF2Asqj4k44CpJo0c7gAySdbIQNaY9YpTW0L1TatwIDAQAB Explanation of parameters: v=DKIM1 — DKIM version h=sha256 — hash algorithm (usually sha256 is used, sometimes sha1) k=rsa — key type p=... — public key (corresponds to the contents of the file example.com.pub)