Настройка DKIM на Postfix

Егор Васильев Unix Mail 27.08.201809.10.2018DKIM, DNS, Postfix, Postfix configuring, Postfix relay 0 Comment

Настройка DKIM на Postfix упирается в установку дополнительного компонента — OpenDKIM, а со стороны Postfix необходимо добавить лишь несколько строчек. Помимо этого, вам надо будет также добавить DNS-запись у вашего регистратора (ну или на вашем DNS-сервере, если зона делегирована вам).

Теперь обо всем подробнее.

Если вам интересна тематика почтовых серверов, рекомендую обратиться к соответствующей рубрике на моем блоге — Mail Servers.

Содержание

1 Настройка DKIM на Postfix

Настройка DKIM на Postfix

Если пока вы чувствуете себя неуверенно с DKIM, рекомендую прочитать статью Технология DKIM для почтового сервера.

В качестве тестового домена будет использоваться bq-srv.ru.

Установка

С установкой на Debian все просто:

apt-get install -y opendkim \
                   opendkim-tools

1 2	apt-get install -y opendkim \ opendkim-tools

Переходим к настройке.

Ключи

Начинать настройку OpenDKIM будет логичнее всего с генерации пары ключей — закрытого и открытого. Сделать это можно локально на сервере с помощью утилиты opendkim-genkey, но для начала создадим отдельный каталог с необходимыми правами и выставим нужного владельца:

mkdir -m 750 /etc/opendkim && chown opendkim:opendkim /etc/opendkim

1	mkdir -m 750 /etc/opendkim && chown opendkim:opendkim /etc/opendkim

А теперь создаем ключи:

opendkim-genkey -D /etc/opendkim \
                --domain=$(postconf -h mydomain) \
                --selector=mail

opendkim-genkey -D /etc/opendkim \

--domain=$(postconf -h mydomain) \

--selector=mail

Примечание: уже на этом этапе вам надо определиться с именем селектора, в моем случае это mail. Если не знаете что это такое, почитайте статью про DKIM — см. выше. Также, если вы настраивали Postfix по моей статье — Простейший relay на Postfix для Exchange Server, то команда postconf -h mydomain вернет имя вашего домена. В противном случае вам нужно прописать домен в поле —domain=your_domain самостоятельно.

После выполнения команды будут созданы два файла — mail.private и mail.txt. Вы можете посмотреть их содержимое, если интересно. Один из этих файлов нам понадобится уже в следующей главе.

Выставим нужные права на файл закрытого ключа:

chown opendkim:opendkim /etc/opendkim/mail.private
chmod 600 /etc/opendkim/mail.private

1 2	chown opendkim:opendkim /etc/opendkim/mail.private chmod 600 /etc/opendkim/mail.private

Можно создавать записи.

Записи DNS

Чтобы не тратить время впустую, ожидая распространения DNS-записей, разумно добавить DKIM-запись уже сейчас, а потом спокойно заниматься настройкой. Напомню, что потребуется создать запись TXT. Её вы можете найти в файле /etc/opendkim/mail.txt и она уже имеет нужный вид:

mail._domainkey IN      TXT     ( "v=DKIM1; h=sha256; k=rsa; "
          "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwY3QT9H4zJk3aLfMcXkyMG7qLdKA75vVAmA+Trz5t3ulE9H9MFa8xY2dHjDHjJECRV4ZR2MwNN1kmbsS832qQ9Owp7Zu1g1Fn+8xr15u0vzOR3tv1Jm8LXLf16HerSCGz84Ky25CkY+Gkzif0fmk9WSJPMBcTCYEnap+vd8k9IhENPSsfaDeoUCuWT1Ai53YgbECImatIrKz5P"
          "8b+5hsdddsgMviphMsJQ5NupYioFmwMT4RlEO9zbRjOrXwuEi5O0cpXilHpLIypiJUv1Up/DFQThwhbwDL++cOmnGnbWAjbTdfop1rW9Jk7dhl7vEzX0BSXwFg1yI9N1Amc2a5HwIDAQAB" )  ; ----- DKIM key mail for bq-srv.ru

mail._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; "

"p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwY3QT9H4zJk3aLfMcXkyMG7qLdKA75vVAmA+Trz5t3ulE9H9MFa8xY2dHjDHjJECRV4ZR2MwNN1kmbsS832qQ9Owp7Zu1g1Fn+8xr15u0vzOR3tv1Jm8LXLf16HerSCGz84Ky25CkY+Gkzif0fmk9WSJPMBcTCYEnap+vd8k9IhENPSsfaDeoUCuWT1Ai53YgbECImatIrKz5P"

"8b+5hsdddsgMviphMsJQ5NupYioFmwMT4RlEO9zbRjOrXwuEi5O0cpXilHpLIypiJUv1Up/DFQThwhbwDL++cOmnGnbWAjbTdfop1rW9Jk7dhl7vEzX0BSXwFg1yI9N1Amc2a5HwIDAQAB" ) ; ----- DKIM key mail for bq-srv.ru

Примечание: напомню, что если вы упираетесь в максимальную длину записи в 255 символов и регистратор не дает создать запись длиннее, есть обходное решение ¹. В противном случае обратитесь в поддержку регистратора.

Переходим к настройке.

Настройка OpenDKIM

Основные настройки OpenDKIM находятся в файле /etc/opendkim.conf. Оставим его оригинал в качестве бэкапа, а на его месте создадим новый пустой файл:

mv /etc/opendkim.conf{,.backup} && > /etc/opendkim.conf

1	mv /etc/opendkim.conf{,.backup} && > /etc/opendkim.conf

Открываем его для редактирования и вставляем содержимое:

AlwaysAddARHeader       Yes
SubDomains              Yes
RemoveARAll             Yes
RemoveOldSignatures     Yes
SendReports             Yes
Canonicalization        relaxed/relaxed
Mode                    sv
UserID                  opendkim:opendkim

Syslog                  Yes
SyslogSuccess           Yes
LogWhy                  Yes

KeyTable                /etc/opendkim/KeyTable
SigningTable            refile:/etc/opendkim/SigningTable

ExternalIgnoreList      refile:/etc/opendkim/TrustedHosts
InternalHosts           refile:/etc/opendkim/TrustedHosts

Nameservers             8.26.56.26,8.20.247.20
PidFile                 /var/run/opendkim/opendkim.pid
Socket                  inet:10021@localhost
ReportAddress           "DKIM Error Postmaster" <postmaster@bq-srv.ru>

AlwaysAddARHeader Yes

SubDomains Yes

RemoveARAll Yes

RemoveOldSignatures Yes

SendReports Yes

Canonicalization relaxed/relaxed

Mode sv

UserID opendkim:opendkim

Syslog Yes

SyslogSuccess Yes

LogWhy Yes

KeyTable /etc/opendkim/KeyTable

SigningTable refile:/etc/opendkim/SigningTable

ExternalIgnoreList refile:/etc/opendkim/TrustedHosts

InternalHosts refile:/etc/opendkim/TrustedHosts

Nameservers 8.26.56.26,8.20.247.20

PidFile /var/run/opendkim/opendkim.pid

Socket inet:10021@localhost

ReportAddress "DKIM Error Postmaster" <postmaster@bq-srv.ru>

Традиционно небольшое описание ² каждого параметра ниже.

##  AlwaysAddARHeader { yes | no }
##  	default "no"
##
##  Add an "Authentication-Results:" header even to unsigned messages
##  from domains with no "signs all" policy.  The reported DKIM result
##  will be "none" in such cases.  Normally unsigned mail from non-strict
##  domains does not cause the results header to be added.
AlwaysAddARHeader       Yes

##  SubDomains { yes | no }
##  	default "no"
##
##  Sign for subdomains as well?
SubDomains              Yes

##  RemoveARAll { yes | no }
##  	default "no"
##
##  Remove all Authentication-Results: headers on all arriving mail.
RemoveARAll             Yes

##  RemoveOldSignatures { yes | no }
##  	default "no"
##
##  Remove old signatures on messages, if any, when generating a signature.
RemoveOldSignatures     Yes

##  SendReports { yes | no }
##  	default "no"
##
##  Specifies whether or not the filter should generate report mail back
##  to senders when verification fails and an address for such a purpose
##  is provided.  See opendkim.conf(5) for details.
SendReports             Yes

##  Canonicalization hdrcanon[/bodycanon]
##  	default "simple/simple"
##
##  Select canonicalizations to use when signing.  If the "bodycanon" is
##  omitted, "simple" is used.  Valid values for each are "simple" and
##  "relaxed".
Canonicalization        relaxed/relaxed

##  Mode [sv]
##  	default sv
##
##  Indicates which mode(s) of operation should be provided.  "s" means
##  "sign", "v" means "verify".
Mode                    sv

##  Userid userid
##  	default (none)
##
##  Change to user "userid" before starting normal operation?  May include
##  a group ID as well, separated from the userid by a colon.
UserID                  opendkim:opendkim

##  Syslog { yes | no }
##  	default "yes"
##
##  Log informational and error activity to syslog?
Syslog                  Yes

##  SyslogSuccess { yes | no }
##  	default "no"
##
##  Log success activity to syslog?
SyslogSuccess           Yes

##  LogWhy { yes | no }
##  	default "no"
##
##  If logging is enabled (see Syslog below), issues very detailed logging
##  about the logic behind the filter's decision to either sign a message
##  or verify it.  The logic behind the decision is non-trivial and can be
##  confusing to administrators not familiar with its operation.  A
##  description of how the decision is made can be found in the OPERATIONS
##  section of the opendkim(8) man page.  This causes a large increase
##  in the amount of log data generated for each message, so it should be
##  limited to debugging use and not enabled for general operation.
LogWhy                  Yes

##  KeyTable dataset
##  	default (none)
##
##  Defines a table that will be queried to convert key names to
##  sets of data of the form (signing domain, signing selector, private key).
##  The private key can either contain a PEM-formatted private key,
##  a base64-encoded DER format private key, or a path to a file containing
##  one of those.
KeyTable                /etc/opendkim/KeyTable

##  SigningTable dataset
##  	default (none)
##
##  Defines a dataset that will be queried for the message sender's address
##  to determine which private key(s) (if any) should be used to sign the
##  message.  The sender is determined from the value of the sender
##  header fields as described with SenderHeaders above.  The key for this
##  lookup should be an address or address pattern that matches senders;
##  see the opendkim.conf(5) man page for more information.  The value
##  of the lookup should return the name of a key found in the KeyTable
##  that should be used to sign the message.  If MultipleSignatures
##  is set, all possible lookup keys will be attempted which may result
##  in multiple signatures being applied.
SigningTable            refile:/etc/opendkim/SigningTable

##  ExternalIgnoreList filename
##
##  Names a file from which a list of externally-trusted hosts is read.
##  These are hosts which are allowed to send mail through you for signing.
##  Automatically contains 127.0.0.1.  See man page for file format.
ExternalIgnoreList      refile:/etc/opendkim/TrustedHosts

##  InternalHosts dataset
##  	default "127.0.0.1"
##
##  Names a file from which a list of internal hosts is read.  These are
##  hosts from which mail should be signed rather than verified.
##  Automatically contains 127.0.0.1.
InternalHosts           refile:/etc/opendkim/TrustedHosts

##  Nameservers addr1[,addr2[,...]]
##  	default (none)
##
##  Provides a comma-separated list of IP addresses that are to be used when
##  doing DNS queries to retrieve DKIM keys, VBR records, etc.
##  These override any local defaults built in to the resolver in use, which
##  may be defined in /etc/resolv.conf or hard-coded into the software.
Nameservers            8.26.56.26, 8.20.247.20

##  PidFile filename
##  	default (none)
## 
##  Name of the file where the filter should write its pid before beginning
##  normal operations.
PidFile                 /var/run/opendkim/opendkim.pid

##  Socket socketspec
##
##  Names the socket where this filter should listen for milter connections
##  from the MTA.  Required.  Should be in one of these forms:
##
##  inet:port@address		to listen on a specific interface
##  inet:port			to listen on all interfaces
##  local:/path/to/socket	to listen on a UNIX domain socket
Socket                  inet:10021@localhost

##  ReportAddress addr
##  	default (executing user)@(hostname)
##
##  Specifies the sending address to be used on From: headers of outgoing
##  failure reports.  By default, the e-mail address of the user executing
##  the filter is used.
ReportAddress           "DKIM Error Postmaster" <postmaster@bq-srv.ru>

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

## AlwaysAddARHeader { yes | no }

## default "no"

## Add an "Authentication-Results:" header even to unsigned messages

## from domains with no "signs all" policy. The reported DKIM result

## will be "none" in such cases. Normally unsigned mail from non-strict

## domains does not cause the results header to be added.

AlwaysAddARHeader Yes

## SubDomains { yes | no }

## default "no"

## Sign for subdomains as well?

SubDomains Yes

## RemoveARAll { yes | no }

## default "no"

## Remove all Authentication-Results: headers on all arriving mail.

RemoveARAll Yes

## RemoveOldSignatures { yes | no }

## default "no"

## Remove old signatures on messages, if any, when generating a signature.

RemoveOldSignatures Yes

## SendReports { yes | no }

## default "no"

## Specifies whether or not the filter should generate report mail back

## to senders when verification fails and an address for such a purpose

## is provided. See opendkim.conf(5) for details.

SendReports Yes

## Canonicalization hdrcanon[/bodycanon]

## default "simple/simple"

## Select canonicalizations to use when signing. If the "bodycanon" is

## omitted, "simple" is used. Valid values for each are "simple" and

## "relaxed".

Canonicalization relaxed/relaxed

## Mode [sv]

## default sv

## Indicates which mode(s) of operation should be provided. "s" means

## "sign", "v" means "verify".

Mode sv

## Userid userid

## default (none)

## Change to user "userid" before starting normal operation? May include

## a group ID as well, separated from the userid by a colon.

UserID opendkim:opendkim

## Syslog { yes | no }

## default "yes"

## Log informational and error activity to syslog?

Syslog Yes

## SyslogSuccess { yes | no }

## default "no"

## Log success activity to syslog?

SyslogSuccess Yes

## LogWhy { yes | no }

## default "no"

## If logging is enabled (see Syslog below), issues very detailed logging

## about the logic behind the filter's decision to either sign a message

## or verify it. The logic behind the decision is non-trivial and can be

## confusing to administrators not familiar with its operation. A

## description of how the decision is made can be found in the OPERATIONS

## section of the opendkim(8) man page. This causes a large increase

## in the amount of log data generated for each message, so it should be

## limited to debugging use and not enabled for general operation.

LogWhy Yes

## KeyTable dataset

## default (none)

## Defines a table that will be queried to convert key names to

## sets of data of the form (signing domain, signing selector, private key).

## The private key can either contain a PEM-formatted private key,

## a base64-encoded DER format private key, or a path to a file containing

## one of those.

KeyTable /etc/opendkim/KeyTable

## SigningTable dataset

## default (none)

## Defines a dataset that will be queried for the message sender's address

## to determine which private key(s) (if any) should be used to sign the

## message. The sender is determined from the value of the sender

## header fields as described with SenderHeaders above. The key for this

## lookup should be an address or address pattern that matches senders;

## see the opendkim.conf(5) man page for more information. The value

## of the lookup should return the name of a key found in the KeyTable

## that should be used to sign the message. If MultipleSignatures

## is set, all possible lookup keys will be attempted which may result

## in multiple signatures being applied.

SigningTable refile:/etc/opendkim/SigningTable

## ExternalIgnoreList filename

## Names a file from which a list of externally-trusted hosts is read.

## These are hosts which are allowed to send mail through you for signing.

## Automatically contains 127.0.0.1. See man page for file format.

ExternalIgnoreList refile:/etc/opendkim/TrustedHosts

## InternalHosts dataset

## default "127.0.0.1"

## Names a file from which a list of internal hosts is read. These are

## hosts from which mail should be signed rather than verified.

## Automatically contains 127.0.0.1.

InternalHosts refile:/etc/opendkim/TrustedHosts

## Nameservers addr1[,addr2[,...]]

## default (none)

## Provides a comma-separated list of IP addresses that are to be used when

## doing DNS queries to retrieve DKIM keys, VBR records, etc.

## These override any local defaults built in to the resolver in use, which

## may be defined in /etc/resolv.conf or hard-coded into the software.

Nameservers 8.26.56.26, 8.20.247.20

## PidFile filename

## default (none)

## Name of the file where the filter should write its pid before beginning

## normal operations.

PidFile /var/run/opendkim/opendkim.pid

## Socket socketspec

## Names the socket where this filter should listen for milter connections

## from the MTA. Required. Should be in one of these forms:

## inet:port@address to listen on a specific interface

## inet:port to listen on all interfaces

## local:/path/to/socket to listen on a UNIX domain socket

Socket inet:10021@localhost

## ReportAddress addr

## default (executing user)@(hostname)

## Specifies the sending address to be used on From: headers of outgoing

## failure reports. By default, the e-mail address of the user executing

## the filter is used.

ReportAddress "DKIM Error Postmaster" <postmaster@bq-srv.ru>

Каждая строка файла /etc/opendkim/KeyTable задает соответствие селектор — домен — закрытый ключ. Разумеется вы можете иметь сколько угодно доменов и селекторов:

mail._domainkey.bq-srv.ru bq-srv.ru:mail:/etc/opendkim/mail.private

1	mail._domainkey.bq-srv.ru bq-srv.ru:mail:/etc/opendkim/mail.private

Соответствия отправителей и селектора определяет файл /etc/opendkim/SigningTable. По сути, второе значение каждой строки SigningTable соответствует первому значению файла KeyTable:

*@bq-srv.ru mail._domainkey.bq-srv.ru

1	*@bq-srv.ru mail._domainkey.bq-srv.ru

Файл /etc/opendkim/TrustedHosts используется для двух целей одновременно. Он определяет список внутренних (InternalHosts) и внешних (ExternalIgnoreList) хостов, с которых всю почту надо подписывать, а не проверять.

127.0.0.1
localhost
172.16.0.20
*.bq-srv.ru

127.0.0.1

localhost

172.16.0.20

*.bq-srv.ru

На стороне OpenDKIM настройка завершена, теперь необходимо научить Postfix отдавать письма на подпись.

Настройка Postfix

Чтобы Postfix после всех манипуляций подписывал сообщение, необходимо добавить всего три строки в конфиг /etc/postfix/main.cf:

milter_default_action = accept
smtpd_milters = inet:localhost:10021
non_smtpd_milters = inet:localhost:10021

milter_default_action = accept

smtpd_milters = inet:localhost:10021

non_smtpd_milters = inet:localhost:10021

Напомню, что сам Postfix ничего не знает о DKIM и в процессе обработки сообщения лишь на время отправляет его OpenDKIM и, как только тот его подпишет, принимает его обратно и отсылает конечным получателям. В терминологии Postfix эта технология называется Milter (mail filter ³).

Добавьте проверку DKIM самой последней, но перед DMARC (если она имеется).

Проверка работы

А теперь отправим тестовое письмо и после этого проверим содержимое лог-файлов (по умолчанию /var/log/mail.log). Хочу напомнить, что моя лаба представляет из себя связку Exchange Server 2016 + релэй на Postfix, который я начал настраивать в статье Простейший relay на Postfix для Exchange Server. Итак, логи:

postfix/smtpd[35561]: connect from exch01.sc.local[172.16.0.20]
postfix/smtpd[35561]: 016117F3F7: client=exch01.sc.local[172.16.0.20]
postfix/cleanup[35566]: 016117F3F7: message-id=<4212dd5e05504b6b9b118743d8b6860e@bq-srv.ru>
opendkim[32872]: 016117F3F7: DKIM-Signature field added (s=mail, d=bq-srv.ru)
postfix/qmgr[35554]: 016117F3F7: from=<e.vasilev@bq-srv.ru>, size=14453, nrcpt=1 (queue active)
postfix/smtpd[35561]: disconnect from exch01.sc.local[172.16.0.20] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7
postfix/smtp[35567]: 016117F3F7: to=<e.s.vasilyev@mail.ru>, relay=mxs.mail.ru[94.100.180.104]:25, delay=2.4, delays=0.09/0/0.05/2.2, dsn=2.0.0, status=sent (250 OK id=1fknJI-00071n-9W)
postfix/qmgr[35554]: 016117F3F7: removed

postfix/smtpd[35561]: connect from exch01.sc.local[172.16.0.20]

postfix/smtpd[35561]: 016117F3F7: client=exch01.sc.local[172.16.0.20]

postfix/cleanup[35566]: 016117F3F7: message-id=<4212dd5e05504b6b9b118743d8b6860e@bq-srv.ru>

opendkim[32872]: 016117F3F7: DKIM-Signature field added (s=mail, d=bq-srv.ru)

postfix/qmgr[35554]: 016117F3F7: from=<e.vasilev@bq-srv.ru>, size=14453, nrcpt=1 (queue active)

postfix/smtpd[35561]: disconnect from exch01.sc.local[172.16.0.20] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7

postfix/smtp[35567]: 016117F3F7: to=<e.s.vasilyev@mail.ru>, relay=mxs.mail.ru[94.100.180.104]:25, delay=2.4, delays=0.09/0/0.05/2.2, dsn=2.0.0, status=sent (250 OK id=1fknJI-00071n-9W)

postfix/qmgr[35554]: 016117F3F7: removed

Примечание: если вдруг возникают сложности с поиском логов, то помните, что ваша главная задача — найти идентификатор сообщения и уже по нему фильтровать. Сразу после отправки сообщения на сервере-релэе вы можете просмотреть последние записи в логах командой:
# tail -n 40 /var/log/mail.log
Идентификатор сообщения представляет из себя десятисимвольную запись (пример — 016117F3F7). Скопируйте его и выполните уже другую команду:
# grep -e ‘016117F3F7’ /var/log/mail.log
После этого вы получите все записи, связанные с обработкой сообщение, которому присвоен идентификатор 016117F3F7.

Видно, что письмо приходит с эксча, подписывается (DKIM-Signature field added), ставится в очередь на отправку и отправляется со статусом ОК. На принимающей стороне просматриваем заголовки сообщения и видим:

dkim=pass header.d=bq-srv.ru

1	dkim=pass header.d=bq-srv.ru

А также саму подпись:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bq-srv.ru; s=mail;
	t=1533115247; bh=e6IZE49kmkJx8p6ujrQuU4DncHDsIuDx0vpJjbn+Azw=;
	h=From:To:Subject:Date:References:In-Reply-To;
	b=h+B10b3fSfDqkvhE4TBcmOXNggZkmkfGzA3yRoabesHCWmohF5OFPPh2GAq1QDHQs
	 QFm3yVv1FtLA5KWBY7fr/wceds5FE3VXeU98bXgEzvG4e9rOZrHgUJ1FFv3tkIGrZ+
	 3dpOsv0y8JVpawwy/A9KmQpgf//qggmCzt7jPCanGVeiQbZiIxSpRV59HFS+ADMl4O
	 kVILB5RTE3bbaDQxBX3fbBVHli3a/8usU0Lf/xWDUOAZJSKuxeb/oGnE5Ww6QfHJOJ
	 ATD1cNcgHjgvVkG04QVuGIwWN9n/WHUBBrjEEsmTqUzJwVsS0xkEusjC6ssU2v5S4A
	 cBNSKoELPD9jQ==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bq-srv.ru; s=mail;

t=1533115247; bh=e6IZE49kmkJx8p6ujrQuU4DncHDsIuDx0vpJjbn+Azw=;

h=From:To:Subject:Date:References:In-Reply-To;

b=h+B10b3fSfDqkvhE4TBcmOXNggZkmkfGzA3yRoabesHCWmohF5OFPPh2GAq1QDHQs

QFm3yVv1FtLA5KWBY7fr/wceds5FE3VXeU98bXgEzvG4e9rOZrHgUJ1FFv3tkIGrZ+

3dpOsv0y8JVpawwy/A9KmQpgf//qggmCzt7jPCanGVeiQbZiIxSpRV59HFS+ADMl4O

kVILB5RTE3bbaDQxBX3fbBVHli3a/8usU0Lf/xWDUOAZJSKuxeb/oGnE5Ww6QfHJOJ

ATD1cNcgHjgvVkG04QVuGIwWN9n/WHUBBrjEEsmTqUzJwVsS0xkEusjC6ssU2v5S4A

cBNSKoELPD9jQ==

Релэй правильно подписывает отсылаемые сообщения, но надо удостовериться, что он не забывает проверять подписи у сообщений, которые приходят снаружи на внутренний сервер. Пробуем отправить сообщение с любого внешнего сервера и смотрим логи:

postfix/smtpd[99428]: B82D87F06E: client=f487.i.mail.ru[217.69.138.154]
postfix/cleanup[99431]: B82D87F06E: message-id=<1538598858.628412344@f487.i.mail.ru>
opendkim[99420]: B82D87F06E: f487.i.mail.ru [217.69.138.154] not internal
opendkim[99420]: B82D87F06E: not authenticated
opendkim[99420]: B82D87F06E: DKIM verification successful
opendkim[99420]: B82D87F06E: s=mail2 d=mail.ru SSL
postfix/qmgr[35554]: B82D87F06E: from=<e.s.vasilyev@mail.ru>, size=2964, nrcpt=1 (queue active)
postfix/smtp[99433]: B82D87F06E: to=<e.vasilev@bq-srv.ru>, relay=exch01.sc.local[172.16.0.20]:25, delay=0.41, delays=0.23/0/0/0.17, dsn=2.6.0, status=sent (250 2.6.0 <1538598858.628412344@f487.i.mail.ru> [InternalId=77296526426123, Hostname=EXCH01.sc.local] 4748 bytes in 0.161, 28,667 KB/sec Queued mail for delivery)
postfix/qmgr[35554]: B82D87F06E: removed

postfix/smtpd[99428]: B82D87F06E: client=f487.i.mail.ru[217.69.138.154]

postfix/cleanup[99431]: B82D87F06E: message-id=<1538598858.628412344@f487.i.mail.ru>

opendkim[99420]: B82D87F06E: f487.i.mail.ru [217.69.138.154] not internal

opendkim[99420]: B82D87F06E: not authenticated

opendkim[99420]: B82D87F06E: DKIM verification successful

opendkim[99420]: B82D87F06E: s=mail2 d=mail.ru SSL

postfix/qmgr[35554]: B82D87F06E: from=<e.s.vasilyev@mail.ru>, size=2964, nrcpt=1 (queue active)

postfix/smtp[99433]: B82D87F06E: to=<e.vasilev@bq-srv.ru>, relay=exch01.sc.local[172.16.0.20]:25, delay=0.41, delays=0.23/0/0/0.17, dsn=2.6.0, status=sent (250 2.6.0 <1538598858.628412344@f487.i.mail.ru> [InternalId=77296526426123, Hostname=EXCH01.sc.local] 4748 bytes in 0.161, 28,667 KB/sec Queued mail for delivery)

postfix/qmgr[35554]: B82D87F06E: removed

Из логов видно, что сообщение получено, DKIM подпись проверена и является валидной, а далее сообщение направлено на конечный сервер EXCH01.

Настройка на этом завершена.

Notes:

comments powered by HyperComments

2resting-place

2022-07-04 22:50:59

1believes

dissertation writing memes

2022-07-05 16:18:49

tips on writing a dissertation https://professionaldissertationwriting.org/

dissertation

2022-07-05 17:09:39

masters dissertation help https://professionaldissertationwriting.com/

doctoral dissertation help

2022-07-06 00:08:42

dissertation writing service https://dissertationwritingcenter.com/

dissertation express

2022-07-06 00:44:22

writing your dissertation in https://dissertationhelpexpert.com/

dissertation defense presentation

2022-07-06 03:18:48

buy the help https://accountingdissertationhelp.com/

phd dissertation help download

2022-07-06 07:06:05

uk dissertation writing https://examplesofdissertation.com/

writing a dissertation

2022-07-06 10:14:56

phd dissertation peer reviewing help https://writing-a-dissertation.net/

writing service

2022-07-06 13:03:28

define dissertation https://bestdissertationwritingservice.net/

dissertation writing service

2022-07-06 14:25:01

rfp writing services https://businessdissertationhelp.com/

help with dissertation

2022-07-06 17:04:13

custom dissertation writing services https://customdissertationwritinghelp.com/

free dissertation help

2022-07-06 22:14:31

need help https://writingadissertationproposal.com/

dissertation paper writing service

2022-07-07 05:50:14

dissertation help service binding https://customthesiswritingservices.com/

best online casino us

2022-07-25 18:47:54

raging bull casino online https://download-casino-slots.com/

secure online casino

2022-07-25 22:20:48

harrington online casino https://firstonlinecasino.org/

free casino slots online

2022-07-26 02:46:08

monarch online casino https://newlasvegascasinos.com/

harrington online casino

2022-07-26 06:03:16

fastest withdrawal online casino https://trust-online-casino.com/

online free casino games

2022-07-26 06:54:46

gta online casino car https://onlinecasinosdirectory.org/

nj casino online sites

2022-07-26 10:28:32

online casino hosting sanjeev beemidi https://9lineslotscasino.com/

online casino games real money

2022-07-26 16:16:11

tropica casino online https://internet-casinos-online.net/

online casino arizona

2022-07-26 17:09:12

vegas casino online no deposit bonus codes https://cybertimeonlinecasino.com/

sugarhouse casino online sportsbook

2022-07-26 20:04:08

wild vegas online casino https://1freeslotscasino.com/

golden casino online

2022-07-26 23:56:58

online casino real money free play https://vrgamescasino.com/

online casino no deposits

2022-07-27 02:43:14

miami online casino https://casino-online-roulette.com/

stardust online casino

2022-07-27 04:38:10

chumba casino online https://casino-online-jackpot.com/

online casino index

2022-07-27 07:41:39

online casino bonuses no deposit https://onlineplayerscasino.com/

online casino usa legal

2022-07-27 13:26:36

borgata online casino atlantic city https://all-online-casino-games.com/

free online casino no deposit

2022-07-27 15:51:42

online casino malaysia https://casino8online.com/

free vpn for chrome

2022-08-07 14:18:09

vpn free ip address https://freevpnconnection.com/

best free vpn for mac

2022-08-07 16:33:54

free lifetime vpn https://shiva-vpn.com/

vpn download free

2022-08-07 20:35:23

best vpn protocols https://freehostingvpn.com/

best free phone vpn

2022-08-07 21:52:03

best free vpn for ipad https://ippowervpn.net/

free phone vpn

2022-08-08 00:39:38

free vpn connection https://imfreevpn.net/

cyber ghost vpn

2022-08-08 02:57:21

free internet vpn https://superfreevpn.net/

best vpn for fire tv

2022-08-08 04:37:55

zenmate vpn free https://free-vpn-proxy.com/

hotspot vpn

2022-08-08 07:17:24

what is vpn on windows https://rsvpnorthvalley.com/

dating gay bbc meet twinks

2022-08-23 14:16:59

gay sex dating https://gay-singles-dating.com/

gay dating charlotte nc

2022-08-23 17:21:49

gay/bi dating apps https://gayedating.com/

older gay men dating sites

2022-08-23 20:07:33

gay dating site younger men for older men https://datinggayservices.com/

dating site asian

2022-08-24 13:21:49

dating near me free https://freephotodating.com/

japan bbw

2022-08-24 15:00:23

international singles https://onlinedatingbabes.com/

tinder dating

2022-08-24 16:46:45

asian dating chat https://adult-singles-online-dating.com/

dating free chating

2022-08-24 19:21:53

100% inspektion https://adult-classifieds-online-dating.com/

date sex

2022-08-25 02:45:24

american dating https://datingpersonalsonline.com/

free sex dating

2022-08-25 04:35:09

single women darling side https://wowdatingsites.com/

online dating sites

2022-08-25 07:16:07

date me site https://lavaonlinedating.com/

online dating game

2022-08-25 08:48:40

free dating sites totally free https://freeadultdatingpasses.com/

singles websites

2022-08-25 12:49:11

single personal ads https://virtual-online-dating-service.com/

free online dating sites with no fees

2022-08-25 13:22:50

best free online dating sites https://zonlinedating.com/

plenty of fish

2022-08-25 16:28:36

free date sites https://onlinedatingservicesecrets.com/

las atlantis casino online

2022-08-30 09:47:42

casino online no deposit https://onlinecasinos4me.com/

parx casino online

2022-08-30 14:53:24

online casino guide https://online2casino.com/

my choice casino online slots

2022-08-30 19:59:22

online casino freispiele https://casinosonlinex.com/

gay phone chat line numbers

2022-09-03 00:50:17

gay kink chat https://newgaychat.com/

boomerang gay chat

2022-09-03 05:36:28

gay chat toms river nj https://gaychatcams.net/

chat with gay thai boys

2022-09-03 09:27:44

gay chat app https://gaychatspots.com/

free rulette gay chat

2022-09-03 17:16:22

bbc gay chat room free https://gay-live-chat.net/

gay chat rouetee

2022-09-03 23:08:23

profile tube boys user gay chat boi https://chatcongays.com/

zoom chat gay

2022-09-04 00:11:29

random gay video chat https://gayphillychat.com/

gay chat room atlanta

2022-09-04 06:57:41

reddit gay chat room https://gaychatnorules.com/

gay chat webcam room facebook free

2022-09-04 10:07:04

gay video cam chat https://gaymusclechatrooms.com/

vietnam gay chat

2022-09-04 17:28:33

gay chat by zip code https://free-gay-sex-chat.com/

gay men snap chat

2022-09-04 20:38:31

gay phone chat lines with free trials https://gayinteracialchat.com/

gay chat webcams

2022-10-20 17:15:19

gay chat phone line locker https://gaymanchatrooms.com/

pay to do my paper

2022-10-21 00:06:01

buy school papers https://writepapersformoney.com/

custom paper services

2022-10-21 01:14:41

buying paper https://write-my-paper-for-me.org/

custom papers

2022-10-21 03:50:16

papers help https://top100custompapernapkins.com/

help me write my paper

2022-10-21 04:46:07

pay someone to do my paper https://researchpaperswriting.org/

help writing college papers

2022-10-21 06:50:22

cheap paper writing services https://cheapcustompaper.org/

order a paper

2022-10-21 08:01:13

paper writing services reviews https://writingpaperservice.net/

write my economics paper

2022-10-21 09:27:56

some to write my paper https://buyessaypaperz.com/

white paper writing services

2022-10-21 14:34:49

buy cheap papers online https://papercranewritingservices.com/

order a paper

2022-10-21 16:14:12

someone to write my paper https://premiumpapershelp.com/

write my paper in apa format

2022-10-21 17:12:15

write my english paper https://ypaywallpapers.com/

help me write my paper

2022-10-21 18:25:15

paper writing services online https://studentpaperhelp.com/

1approximately

2023-01-27 09:46:50

1changelog

coursework help university

2023-02-05 14:45:03

creative writing coursework ideas https://brainycoursework.com/

coursework service

2023-02-05 17:17:32

coursework science https://writingacoursework.com/

design and technology gcse coursework

2023-02-05 19:05:22

https://mycourseworkhelp.net/

coursework

2023-02-05 20:27:52

coursework project https://courseworkdownloads.com/

coursework help

2023-02-05 21:42:52

design technology coursework https://courseworkinfotest.com/

coursework website

2023-02-05 22:51:13

coursework psychology https://coursework-expert.com/

coursework help uk

2023-02-06 01:04:27

coursework history https://buycoursework.org/

coursework help university

2023-02-06 02:18:03

coursework science https://courseworkdomau.com/

dating agency login

2023-02-08 13:11:53

dating sims https://freewebdating.net/

sating websites

2023-02-08 14:41:48

best dating apps https://jewish-dating-online.net/

free single site

2023-02-08 16:24:20

single chat sites https://free-dating-sites-free-personals.com/

singles and personals

2023-02-08 17:21:40

absolutely free dating site https://sexanddatingonline.com/

single seniors dating sites

2023-02-08 20:22:00

dating single online https://onlinedatingsuccessguide.com/

japan bbw

2023-02-08 23:08:26

game online woman https://datingwebsiteshopper.com/

best online meeting websites

2023-02-09 00:15:05

free adult chat rooms https://allaboutdatingsites.com/

fdating site

2023-02-09 01:04:44

dating sifes https://freedatinglive.com/

meet singles for free

2023-02-09 02:09:05

matchmaking dating https://freewebdating.net/