DKIM, Dmarc, and spf configuration for a noob?

Support General Configuration
21

Hello Ioan,

to my understanding the DNS entry normally should be myselector._domainkeyso that the domain administration UI will create the dns txt field myselector._domainkey.mydomain.xyz

According to this the routing rule selector text field should match the myselector text. Right?

Tbh the testing for my configuration was done two days ago as per your instructions.
I did get the processing error as reported above and worked as stated.

I checked only a couple of emails sent to gmail address. Perhaps it worked normally momentarily.

Today after your consideration I changed it back to the guideline rule and guess what.
It works. :relieved_face:

Perhaps it had to do with dns propagation which I’m sure I checked but hey, you know what they say: technologiaaa :grinning_face:

One thing though:

I’m using an smtp relay to send out emails.

Test email to gmail address shows double DKIM check if I’m interpreting correctly. One for the smtp relay which has been configured as the initial message sender and then my axgn machine. Both dkim entries are configured in my DNS for my domain,

The check txt from gmail received mail is as follows:

ARC-Authentication-Results: i=2; mx.google.com;
dkim=pass header.i=@mydomain.xyz header.s=smtprelay header.b=abcdef;
dkim=neutral (body hash did not verify) header.i=@mydomain.xyz header.s=myselector header.b=ghijkl;
arc=pass (i=1 spf=pass spfdomain=mydomain.xyz dkim=pass dkdomain=mydomain.xyz dmarc=pass fromdomain=mydomain.xyz>);
spf=pass (google.com: domain of user1@mydomain.xyz designates 111.112.113.114 as permitted sender)
smtp.mailfrom=user1@mydomain.xyz;
dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=mydomain.xyz

Messages are accepted normally to gmail
Any ideas as to what the “body hash did not verify” message means?

rgrds

Miltos

22

If you have in DNS a record for:

my-selector._domaikey.my-domain.tld

than you should use, at least in Axigen, the DKIM Selector set to the value of my-selector.

Note: usually you choose the selector word and only after that you publish the associated DNS record.

There are no other options because this is how it should be done (explained extensively in this thread, also in our documentation).

The DNS entry is used only by the recipient email service where the included DKIM signature(s) are validated.

This is because the server that is signing the message (Axigen in this case) needs only to know:

  • the private key (to be read from a file)
  • the selector word

Regarding your specific case (using an intermediate SMTP relay): there is no need for them to sign your messages (and, actually, I suggest to opt-out in case you are not using an authenticated session to pass your messages to them).

Body hash should mean that the email content was altered after being signed, causing the calculated body hash to not match the one in the DKIM signature.

HTH,
Ioan

23

Hello, I already have pem.but I don’t know in Docker, pem should in where?