<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style></head><body lang=en-FI link=blue vlink="#954F72"><div class=WordSection1><p class=MsoNormal>There is an in-built way in amavis to do dkim signing in amavis. Submitting docs is however laborious so I have not done that. Heres the hard part:</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>### Add listener on 10028 for DKIM signing and define amavis policy for said listener</p><p class=MsoNormal>$inet_socket_port = [10024,10028];</p><p class=MsoNormal>$interface_policy{'10028'} = 'DKIM';</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>### Define DKIM key and signing maps ### YOU NEED TO GENERATE THE KEY FOR Kolab TO WORK ###</p><p class=MsoNormal>dkim_key('supersik.net', 'dkim', '/var/lib/amavis/db/example.org.pem', h=>'sha256', k=>'rsa');</p><p class=MsoNormal>@dkim_signature_options_bysender_maps = ( {</p><p class=MsoNormal> "supersik.net" => { d => "example.org", a => 'rsa-sha256', ttl => 10*24*3600 },</p><p class=MsoNormal>});</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>### Disable "Received:" insert to prevent breaking DKIM in header cleanup ### ENABLE THESE IF YOU NEED TO DEBUG AMAVIS IN THE PATH ###</p><p class=MsoNormal>$insert_received_line = 0;</p><p class=MsoNormal>$allowed_added_header_fields{lc('Received')} = 0;</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>### Start DKIM policy-bank sub-configuration</p><p class=MsoNormal>$policy_bank{'DKIM'} = {</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>### Enable 'DKIM signing in addition to extra default checks by amavis inside policy bank to prevent double-signing and feed mail back to postfix</p><p class=MsoNormal>enable_dkim_signing => 1,</p><p class=MsoNormal>forward_method => 'smtp:[127.0.0.1]:10029',</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>### Dont add a second virus scan header</p><p class=MsoNormal>X_HEADER_LINE => "",</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>};</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Postfix config:</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal># Send mail second time to amavis for DKIM</p><p class=MsoNormal>smtp-amavis-dkim unix - - n - 3 smtp</p><p class=MsoNormal> -o smtp_data_done_timeout=1800</p><p class=MsoNormal> -o disable_dns_lookups=yes</p><p class=MsoNormal> -o smtp_send_xforward_command=yes</p><p class=MsoNormal> -o max_use=20</p><p class=MsoNormal> -o smtp_bind_address=127.0.0.1</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal># Listener to re-inject email from DKIM signing</p><p class=MsoNormal>127.0.0.1:10029 inet n - n - 100 smtpd</p><p class=MsoNormal> -o cleanup_service_name=cleanup_internal</p><p class=MsoNormal> -o content_filter=</p><p class=MsoNormal> -o local_recipient_maps=</p><p class=MsoNormal> -o relay_recipient_maps=</p><p class=MsoNormal> -o smtpd_restriction_classes=</p><p class=MsoNormal> -o smtpd_client_restrictions=</p><p class=MsoNormal> -o smtpd_helo_restrictions=</p><p class=MsoNormal> -o smtpd_sender_restrictions=</p><p class=MsoNormal> -o smtpd_recipient_restrictions=permit_mynetworks,reject</p><p class=MsoNormal> -o mynetworks=127.0.0.0/8</p><p class=MsoNormal> -o smtpd_authorized_xforward_hosts=127.0.0.0/8</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I _<i>think</i>_ that’s all config. Might have dismissed something but...</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>-Zapotah</p><p class=MsoNormal><o:p> </o:p></p><div style='mso-element:para-border-div;border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal style='border:none;padding:0cm'><b>From: </b><a href="mailto:petrovic.milan@gmail.com">Milan Petrovic</a><br><b>Sent: </b>Saturday, 19 October 2019 11.51<br><b>To: </b><a href="mailto:users@lists.kolab.org">users@lists.kolab.org</a><br><b>Subject: </b>Re: DKIM setup in Winterfell</p></div><p class=MsoNormal><o:p> </o:p></p></div></body></html>