In today’s digital age, email security is of utmost importance. As an email administrator, it is crucial to implement automated techniques to combat spam and phishing attacks. One such technique is DomainKeys Identified Mail (DKIM), which helps verify the authenticity of emails by adding a digital signature to the header fields. In this tutorial, we will guide you through the process of setting up DKIM with Postfix on Ubuntu 20.04 LTS.

Prerequisites

Before we dive into the installation and configuration process, let’s ensure that you have the necessary prerequisites in place. Firstly, make sure that Postfix is already installed and functioning correctly on your Ubuntu server. If you haven’t set up Postfix yet, you can refer to our tutorial on “How to Install a Mail Server on Ubuntu 20.04 LTS Using Postfix, Dovecot, and Roundcube.”

Step 1: Installing OpenDKIM

To begin, we need to install OpenDKIM, the software that will handle the DKIM signing process. OpenDKIM can be easily installed on Ubuntu 20.04 LTS by running the following command:

sudo apt install opendkim opendkim-tools

This will install the necessary packages for OpenDKIM, including opendkim-tools, which provides additional utilities for managing DKIM.

Step 2: Configuring OpenDKIM

Once OpenDKIM is installed, we can proceed with the configuration. Open the OpenDKIM default configuration file using the following command:

sudo nano /etc/default/opendkim

Within this file, locate the line that starts with SOCKET= and comment it out by adding a # at the beginning. Then, add the following line at the end of the file:

SOCKET="inet:8891@localhost"

Save and exit the editor.

Next, open the OpenDKIM configuration file using the following command:

sudo nano /etc/opendkim.conf

Add the following line at the end of the file:

SOCKET inet:8891@localhost

Save and exit the editor.

Step 3: Configuring Postfix

Now that OpenDKIM is configured, we need to update Postfix to work with DKIM. Open the Postfix main configuration file using the following command:

sudo nano /etc/postfix/main.cf

Add the following lines at the end of the file:

#DKIM
milter_protocol = 6
milter_default_action = accept
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891

Save and exit the editor.

If you have also installed Amavis, you need to update the master configuration file for Postfix. Open the Postfix master configuration file using the following command:

sudo nano /etc/postfix/master.cf

Within this file, locate the lines that start with -o and update them as follows:

-o smtpd_client_connection_count_limit = 0
-o smtpd_client_connection_rate_limit = 0
-o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters

Save and exit the editor.

Step 4: Generating Private Key – Single Domain

Now, let’s generate a private key for a single domain. This private key will be used to sign outgoing emails. We will use the example domain “example.com” for demonstration purposes, but you should replace it with your own domain.

First, update the OpenDKIM configuration file using the following command:

sudo nano /etc/opendkim.conf

Add the following lines at the end of the file:

Domain example.com
KeyFile /etc/postfix/dkim.key
Selector dkim

Save and exit the editor.

To generate the private key and the DNS record entry, run the following command:

sudo opendkim-genkey -t -s dkim -d example.com

This command will generate two files: “dkim.private” and “dkim.txt.”

Next, deploy the private key to Postfix by running the following commands:

sudo mv dkim.private /etc/postfix/dkim.key
sudo chmod 660 /etc/postfix/dkim.key
sudo chown root:opendkim /etc/postfix/dkim.key

Finally, restart OpenDKIM and Postfix to apply the changes:

sudo service opendkim start
sudo service postfix restart

Step 5: Updating DNS

To complete the DKIM configuration, we need to update the DNS record for your domain. Open the “dkim.txt” file using the following command:

sudo cat dkim.txt

The output will display the DKIM record for your domain, which should look similar to this:

dkim._domainkey IN TXT "v=DKIM1; h=sha256; k=rsa; t=y; p=KAABIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA/fedRNEFQvCdtN0akUCMG686J7Kv7DfjP6CBNYbq0zppCF+gEnXmeRIAG1BNGtqE0DnpiOaePwXpuAC+izWHE4pBltSwczhTOz7dNHxQV3YmPs3pg12Zqm4ARuD9sCdJky/Tz+uPHUYp8GUuAJPOmqmg3lWw9AooPOYfJMLte5BeQ7KtSiyxirT5VfZdYj0VJXvvlIKT8X92OYWN8G0212XiFLyyQuxJixQL04BMG0bvBW8xrNDiNuiAkDGea/nUxKRMnuVKOvAa5JAhi/hNikCOP9NCibllwZLlS2E94bY9FVw+ymbBt0f4MMn/Y2LBLfEhLZq0AAx0KXkpPpkWbQIDLSRP"

Remove all double quotes and generate a single-line record. It should look like this:

v=DKIM1;p=KAABIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA/fedRNEFQvCdtN0akUCMG686J7Kv7DfjP6CBNYbq0zppCF+gEnXmeRIAG1BNGtqE0DnpiOaePwXpuAC+izWHE4pBltSwczhTOz7dNHxQV3YmPs3pg12Zqm4ARuD9sCdJky/Tz+uPHUYp8GUuAJPOmqmg3lWw9AooPOYfJMLte5BeQ7KtSiyxirT5VfZdYj0VJXvvlIKT8X92OYWN8G0212XiFLyyQuxJixQL04BMG0bvBW8xrNDiNuiAkDGea/nUxKRMnuVKOvAa5JAhi/hNikCOP9NCibllwZLlS2E94bY9FVw+ymbBt0f4MMn/Y2LBLfEhLZq0AAx0KXkpPpkWbQIDLSRP

Update the DNS record for your domain by adding a TXT record with the following information:

• Name: dkim._domainkey.example.com
• Type: TXT
• Value: “single-line record”
• TTL: 300

Remember to replace “example.com” with your own domain name.

Step 6: DKIM Test

To ensure that DKIM is set up correctly, we can perform a DKIM test. Visit the DKIM Test webpage and click the “Next Step” button to generate an endpoint to receive test emails.

Send an email to the provided endpoint using your domain. The DKIM test should pass successfully, indicating that your emails are properly signed by your domain.

You can also send an email to a Gmail account and check the “Mailed By” and “Signed By” parameters. These should reflect your domain, verifying that the DKIM signature is present.

Conclusion

Congratulations! You have successfully set up DKIM with Postfix on your Ubuntu 20.04 LTS server. By implementing DKIM, you have enhanced the security and authenticity of your outgoing emails, reducing the risk of being flagged as spam or phishing attempts.

Remember to regularly monitor and update your DKIM configuration as needed. By following best practices for email security, you can ensure the reliable and trustworthy delivery of your messages.

For more information and expert assistance with cloud hosting solutions, including Linux SSD VPS, be sure to check out Shape.host. Shape.host offers reliable and scalable hosting services, empowering businesses with secure and efficient cloud solutions.

Christian Wells