<div dir="ltr"><div dir="ltr"><div>Is there any difference in setting up the DKIM signing through Amavis in Winterfell as compared to earlier versions (I'm referring to the available guides in Kolab doc)?</div><div><br></div><div>I'm trying to set it up, following the doc guide thoroughly, but I keep getting the verification failed (not only through some online checking services, but also GMail as a recipient finds the same).</div><div><br></div><div>My amavisd.conf looks like this:</div><div><br></div><div>...</div><div>$inet_socket_port = [10023,10024];  # listen on multiple TCP ports<br><br>$interface_policy{'10023'} = 'SUBMISSION';<br>$policy_bank{'SUBMISSION'} = {<br>    originating => 1,<br>    smtpd_discard_ehlo_keywords => ['8BITGTGpq6rkEc1AIT@dkimvalidator.comMIME']<br>};</div><div>...</div><div>dkim_key(<br>    '<a href="http://mydomain.com">mydomain.com</a>',<br>    'dkim20092019',<br>    '/etc/amavisd/dkim/mydomain.com.dkim20092019.pem'<br>);<br>@dkim_signature_options_bysender_maps = (<br>    {<br>        "<a href="http://mydomain.com">mydomain.com</a>" => {<br>            d   => '<a href="http://mydomain.com">mydomain.com</a>',<br>            a   => 'rsa-sha256',<br>            ttl => 10*24*3600,<br>            c   => 'relaxed/simple'<br>        }<br>    }<br>);<br><br>1;  # insure a defined return value</div><div><br></div><div><br></div><div>And my <a href="http://master.cf">master.cf</a>:</div><div>...</div><div>submission          inet        n        -       n       -       -       smtpd<br>    -o cleanup_service_name=cleanup_submission<br>    -o syslog_name=postfix/submission<br>    -o smtpd_tls_security_level=encrypt<br>    -o smtpd_sasl_auth_enable=yes<br>    -o smtpd_sasl_authenticated_header=yes<br>    -o smtpd_client_restrictions=permit_sasl_authenticated,reject<br>    -o smtpd_data_restrictions=$submission_data_restrictions<br>    -o smtpd_recipient_restrictions=$submission_recipient_restrictions<br>    -o smtpd_sender_restrictions=$submission_sender_restrictions<br>    -o content_filter=smtp-amavis:[127.0.0.1]:10023<br>    -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters</div><div>...</div><div>smtp-amavis         unix        -       -       n       -       3  smtp<br>    -o smtp_data_done_timeout=1800<br>    -o disable_dns_lookups=yes<br>    -o smtp_send_xforward_command=yes<br>    -o max_use=20<br>    -o smtp_bind_address=127.0.0.1<br><br># Listener to re-inject email from Amavisd into Postfix<br><a href="http://127.0.0.1:10025">127.0.0.1:10025</a>     inet        n -       n       -       100     smtpd<br>    -o cleanup_service_name=cleanup_internal<br>    -o content_filter=smtp-wallace:[127.0.0.1]:10026<br>    -o local_recipient_maps=<br>    -o relay_recipient_maps=<br>    -o smtpd_restriction_classes=<br>    -o smtpd_client_restrictions=<br>    -o smtpd_helo_restrictions=<br>    -o smtpd_sender_restrictions=<br>    -o smtpd_recipient_restrictions=permit_mynetworks,reject<br>    -o mynetworks=<a href="http://127.0.0.0/8">127.0.0.0/8</a><br>    -o smtpd_authorized_xforward_hosts=<a href="http://127.0.0.0/8">127.0.0.0/8</a><br></div><div><br></div><div># Filter email through Wallace<br>smtp-wallace        unix        -       -       n       -       3       smtp<br>    -o smtp_data_done_timeout=1800<br>    -o disable_dns_lookups=yes<br>    -o smtp_send_xforward_command=yes<br>    -o max_use=20<br></div><div><br></div><div># Listener to re-inject email from Wallace into Postfix<br><a href="http://127.0.0.1:10027">127.0.0.1:10027</a>     inet        n      -       n       -       100     smtpd<br>    -o cleanup_service_name=cleanup_internal<br>    -o content_filter=<br>    -o local_recipient_maps=<br>    -o relay_recipient_maps=<br>    -o smtpd_restriction_classes=<br>    -o smtpd_client_restrictions=<br>    -o smtpd_helo_restrictions=<br>    -o smtpd_sender_restrictions=<br>    -o smtpd_recipient_restrictions=permit_mynetworks,reject<br>    -o mynetworks=<a href="http://127.0.0.0/8">127.0.0.0/8</a><br>    -o smtpd_authorized_xforward_hosts=<a href="http://127.0.0.0/8">127.0.0.0/8</a></div><div><br></div><div><br></div><div>Sending a test mail to <a href="mailto:auth-results@verifier.port25.com">auth-results@verifier.port25.com</a>, among others, gives the following result:</div><div>DKIM_INVALID           DKIM or DK signature exists, but is not valid</div><div><br></div><div>Similar thing happens with <a href="http://dkimvalidator.com">dkimvalidator.com</a>:</div><div><br></div><div>Validating Signature<br>result = fail<br>Details: message has been altered</div><div><br></div><div> All mails are sent through  Roundcube. <br></div><div><br></div><div><br></div><div>On the other hand, the mxtoolbox' dkim verifier passes. Also the 'amavisd ... testkeys" gives a "pass".</div><div><br></div><div>Excerpt from the amavis' log (everything looks normal to me here):</div><div>...</div><div>Oct 02 01:31:04 <a href="http://mail.mydomain.com">mail.mydomain.com</a> amavis[11404]: (11404-02) header: Received: from <a href="http://mail.mydomain.com">mail.mydomain.com</a> ([127.0.0.1])\n\tby localhost (<a href="http://mail.mydomain.com">mail.mydomain.com</a> [127.0.0.1]) (amavisd-new, port 10028)\n\twith ESMTP id GWd2ey-29lPr for <<a href="mailto:mailAtGmail@gmail.com">mailAtGmail@gmail.com</a>>;\n\tWed,  2 Oct 2019 01:31:03 +0200 (CEST)\n<br>Oct 02 01:31:04 <a href="http://mail.mydomain.com">mail.mydomain.com</a> amavis[11404]: (11404-02) headers CLUSTERING: done all 1 recips in one go<br>Oct 02 01:31:04 <a href="http://mail.mydomain.com">mail.mydomain.com</a> amavis[11404]: (11404-02) dkim: candidate originators: From:<<a href="mailto:milan@mydomain.com">milan@mydomain.com</a>><br>Oct 02 01:31:04 <a href="http://mail.mydomain.com">mail.mydomain.com</a> amavis[11404]: (11404-02) query_keys: cached <a href="mailto:milan@mydomain.com">milan@mydomain.com</a><br>Oct 02 01:31:04 <a href="http://mail.mydomain.com">mail.mydomain.com</a> amavis[11404]: (11404-02) lookup_hash(<a href="mailto:milan@mydomain.com">milan@mydomain.com</a>) matches keys: "<a href="http://mydomain.com">mydomain.com</a>"=>HASH(0x23176e8)<br>Oct 02 01:31:04 <a href="http://mail.mydomain.com">mail.mydomain.com</a> amavis[11404]: (11404-02) lookup [dkim_signature_options_bysender], 1 matches for "<a href="mailto:milan@mydomain.com">milan@mydomain.com</a>", results: "<a href="http://mydomain.com">mydomain.com</a>"=>{c=>"relaxed/simple",a=>"rsa-sha256",ttl=>"864000",d=>"<a href="http://mydomain.com">mydomain.com</a>"}<br>Oct 02 01:31:04 <a href="http://mail.mydomain.com">mail.mydomain.com</a> amavis[11404]: (11404-02) dkim: signature options for <a href="mailto:milan@mydomain.com">milan@mydomain.com</a>(From): c=relaxed/simple; a=rsa-sha256; ttl=864000; d=<a href="http://mydomain.com">mydomain.com</a><br>Oct 02 01:31:04 <a href="http://mail.mydomain.com">mail.mydomain.com</a> amavis[11404]: (11404-02) dkim: signing (author), From: <<a href="mailto:milan@mydomain.com">milan@mydomain.com</a>> (From:<<a href="mailto:milan@mydomain.com">milan@mydomain.com</a>>), KEY.key_ind=>0, a=>rsa-sha256, c=>relaxed/simple, d=><a href="http://mydomain.com">mydomain.com</a>, s=>dkim20092019, ttl=>864000, x=>1570836664<br>Oct 02 01:31:04 <a href="http://mail.mydomain.com">mail.mydomain.com</a> amavis[11404]: (11404-02) write_header: 1, Amavis::Out::SMTP=HASH(0x785b2b8)<br>Oct 02 01:31:04 <a href="http://mail.mydomain.com">mail.mydomain.com</a> amavis[11404]: (11404-02) header encoded (all-ASCII): DKIM-Signature:  v=1; a=rsa-sha256; c=relaxed/simple; d=\n\<a href="http://tmydomain.com">tmydomain.com</a>; h=message-id:user-agent:subject:subject:from\n\t:from:date:date:content-type:content-type:mime-version:received\n\t:received; s=dkim20092019; t=1569972663; x=1570836664; bh=6RpSO+\n\tmd9nsAq4tGBITXXERkubt1wZSk8UUAVzpwGXo=; b=YAkS7Condre4YKZhQidgwl\n\tJEd0Nr73oanUkhOOw7y+hCnwdYWp6yqN5fUhLmAHkg4x7t0URo7SIyoq9Vz6yS9D\n\tSF1GJVLzXIGM/Lcijsa7bFs21WGWW0k4CrsA0YBmtqtPrgk/iTGM/MlWFTIBIzsl\n\tBkRB1mlZYgcUIFMzLuSYpAVlck5r5P0u9YpiDd84Q2HMjoSgu4iQauCN9bO+qLEh\n\tsqzRt40AbABmMpsZT/BQwnnsGjJadHnWXOesl8jrjkMuObMznIxhUt0WwlossViG\n\tp2rOY25WBlcn0lDxX6fqEqGkE2lyqzylSAbH1zd0dSCMnVf1Gy2zBpkmOzHW1hDK\n\tkutMGhEjtcEq+wDjNj4ZUuor0GiHFpR+ipXnIuH8+AdJNVvPMLYKtrNeo8ANw5x2\n\tQ97kD6cB/NzXnB1ukqipEdR/RBK2TytYakQaspmwtii+B3Huryl3Vn+Fbgl3hZbf\n\tseE+4dV2APJcUgo3djB3VDnbr8+HAqBrjn4R1RaTDnwNfaRGqRzeSCpy6bTVh1JS\n\tQNzAG2+cKOK36MCm0NeLZNI7RM590t9ZBmZQRgxf6E4pPBrdbZ1AhfXkIQ+tPuX...<br>Oct 02 01:31:04 <a href="http://mail.mydomain.com">mail.mydomain.com</a> amavis[11404]: (11404-02) ...m\n\tj1YnOl9AzPw14xi06cDy6JTa3iHmUY6w9fptwLKf+GghI8q7pnZDadUTfvtFfvBz\n\tP7P5rXiCbHeY+e7U72Nnk=<br>Oct 02 01:31:04 <a href="http://mail.mydomain.com">mail.mydomain.com</a> amavis[11404]: (11404-02) header: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=\n\<a href="http://tmydomain.com">tmydomain.com</a>; h=message-id:user-agent:subject:subject:from\n\t:from:date:date:content-type:content-type:mime-version:received\n\t:received; s=dkim20092019; t=1569972663; x=1570836664; bh=6RpSO+\n\tmd9nsAq4tGBITXXERkubt1wZSk8UUAVzpwGXo=; b=YAkS7Condre4YKZhQidgwl\n\tJEd0Nr73oanUkhOOw7y+hCnwdYWp6yqN5fUhLmAHkg4x7t0URo7SIyoq9Vz6yS9D\n\tSF1GJVLzXIGM/Lcijsa7bFs21WGWW0k4CrsA0YBmtqtPrgk/iTGM/MlWFTIBIzsl\n\tBkRB1mlZYgcUIFMzLuSYpAVlck5r5P0u9YpiDd84Q2HMjoSgu4iQauCN9bO+qLEh\n\tsqzRt40AbABmMpsZT/BQwnnsGjJadHnWXOesl8jrjkMuObMznIxhUt0WwlossViG\n\tp2rOY25WBlcn0lDxX6fqEqGkE2lyqzylSAbH1zd0dSCMnVf1Gy2zBpkmOzHW1hDK\n\tkutMGhEjtcEq+wDjNj4ZUuor0GiHFpR+ipXnIuH8+AdJNVvPMLYKtrNeo8ANw5x2\n\tQ97kD6cB/NzXnB1ukqipEdR/RBK2TytYakQaspmwtii+B3Huryl3Vn+Fbgl3hZbf\n\tseE+4dV2APJcUgo3djB3VDnbr8+HAqBrjn4R1RaTDnwNfaRGqRzeSCpy6bTVh1JS\n\tQNzAG2+cKOK36MCm0NeLZNI7RM590t9ZBmZQRgxf6E4pPBrdbZ1AhfXkIQ+tPuXm\n\tj1YnOl9AzPw14xi0...<br>Oct 02 01:31:04 <a href="http://mail.mydomain.com">mail.mydomain.com</a> amavis[11404]: (11404-02) ...6cDy6JTa3iHmUY6w9fptwLKf+GghI8q7pnZDadUTfvtFfvBz\n\tP7P5rXiCbHeY+e7U72Nnk=\n</div><div>...<br></div><div><br></div><div>So, is there anything different I should do while setting up the DKIM in Winterfell?</div><div><br></div></div></div>