DKIM + Courier-MTA on CentOS7

Email.  One of those things which is critical to business and depending on what you read and who you speak to, you may be led to believe that it is dying out in favour of instant messaging technologies.  Well, as of right now, I can’t see it dying out any time soon, though it does come with a really annoying, frustrating, excruciating problem.  Junk mail!  Otherwise know as spam!  It has once again become a bit of a problem for me, especially when the likes of yahoo begin to imped the flow of emails leaving one of the servers I have worked on recently unable to send emails to recipients with Yahoo accounts.

Now, don’t get my wrong.  I don’t hold a grudge with any of the large email service providers for blocking spam which has sadly managed to be sent via a mail server I have some involvement with, but I do wish the world wasn’t such a bad place that we have to continuously fight on our email frontiers to protect our virtual/real name and brand.

So anyway.  On with the show

The server

  • CentOS 7
  • Patched to the nines
  • Courier MTA
  • Blocking of known spammers was enabled
  • Spamassassin was used as a secondary measure should the hard blocks fail
  • SPF is configured for all hosted domains
  • DKIM was not configured
  • DMAC was not configured
  • It *was not* an open relay
  • The time was not in sync, which  didn’t help later down the line

The problem

The server’s “reputation” had been tarnished as someone had managed to start sending spam via the server through a vulnerability which was found in one of the websites hosted on the server.

After reviewing the advice from Yahoo, I started my investigation on how to approach this topic.

A bit of googling, led me to this web site; https://www.strangeworld.com/blog/archives/128. Now for me, there were a few things missing in the instructions, though complete were it was most needed.  So recreating some of the  good work done on the strangeworld.com website and providing my own twist on things here;

DKIM & ZDKIMFILTER Pre-requisites

In order to install zdkimfilter you need to manually compile the code and install (a .spec file will be included in future releases which should mean you can just use rpmbuild to create the RPM package for you).  The machine I needed to install this onto did not have any compilers install for reasons of security, and so my list of pre-requisites was rather long and included more than I would have liked but needs must, and the compilers were removed afterwards.  But anyway, here is the list of commands issued to get everything where it needed to be;

sudo rpm -ivh http://www.elrepo.org/elrepo-release-7.0-2.el7.elrepo.noarch.rpm
sudo yum install gcc
sudo yum install openssl-libs openssl-devel
sudo yum install libopendkim opendkim
sudo yum install libtool libidn2 libidn2-devel
sudo yum install opendbx-devel opendbx-mysql opendbx-utils opendbx

Note.  The addition of the elrepo.org rpm is required as there are a couple of dependencies, which don’t appear to be available in the main CentOS yum repository.

Download, compile and install

Now, the original instructions I followed, (see reference material at bottom of this page), took me through the steps of manually compiling the code for and installing opendkim.  After I had installed it, I found that opendkim is available in the CentOS base yum repo and so I could have avoided that step.  You will be pleased to hear that I have not included those steps here (if you do need to know though, see this blog post – strangeworld.com).

Next up we need to obtain the tar ball containing the source code for zdkimfilter, which was downloaded from; http://www.tana.it/sw/zdkimfilter/.  At the time of writing the current version was v1.5.

Now we have that lets work through the process of compiling and installing it.

wget http://www.tana.it/sw/zdkimfilter/zdkimfilter-1.5.tar.gz
tar zxvf zdkimfilter-1.5.tar.gz 
cd zdkimfilter-1.5
./configure --prefix=/usr/local
make -j4
sudo make install

Configuration

Last on the list of installation steps is configuring zdkimfilter and making sure we have the correct directory structure, etc;

cp /etc/courier/filters/zdkimfilter.conf.dist /etc/courier/filters/zdkimfilter.conf
mkdir /etc/courier/filters/keys
chmod u=rwx,g=rw,o-rwx /etc/courier/filters/keys

Nothing more was needed at this time.

Generate some keys and update your DNS zones

At this point, we should have everything installed and configured that we need, and can now proceed with the steps for generating the necessary private keys which will be used to sign our emails as they leave your courier email server and also the public key that will be published in DNS.

A word of warning.  Not sure how important this is, but when looking at generating the keys using opendkim-genkey, I would advise that you choose your selector name carefully.  Initially I set this to be the same as the domain.  I then went to a couple of dkim testing websites and found that one of them didn’t like the “.” (dot) in the selector name.  At this point I changed my plan slightly (in case this was a more wide spread issue) and made sure there were no periods in the selector name.

cd /etc/courier/filters/keys/
opendkim-genkey -b 2048 -d tobyheywood.com -D /etc/courier/filters/keys -s tobyheywood -r --nosubdomains -v
ln -s tobyheywood.private tobyheywood.com
chown root.daemon tobyheywood.*
(Just making sure ownership is correct)
chmod u=rw,g=r,o-rwx tobyheywood.*
(this will change the permissions on the tobyheywood.private file which contains the private key, and the tobyheywood.txt file which contains the public key)

It’s also worth making sure the directory /etc/courier/filters/keys has the right permissions;

chmod u=rwx,g=rx,o-rwx /etc/courier/filters/keys

And also if you are running SELinux, then it is worth double checking the SELinux security context associated with these newly created files.  In my case, I didn’t have to do anything, but best to check.

Now you need to update your DNS zone file(s) with everything in the .txt file up to and including the last “)”.  You could include the rest if you wish, but it’s purely a comment.  Reload you zone and test.

Testing, testing, 1, 2, 3

I performed two types of test.  The first was to make sure the record was returned correctly when queried by third parties and that there were no issues with the DNS side of things.  The website I preferred was; https://www.mail-tester.com/spf-dkim-check as it was a nice and simple site and worked better than the unnamed first site I tried.

The second part of my test, was to send an email to a yahoo or gmail account to confirm that it was accepted and so that I could review the headers.  This turned out to be a very good move!  The headers of my first test emails showed there was no DKIM key present, which I thought was odd, but that was due to the umask and the keys directory didn’t have the execute bit set for group members.  I have corrected this in the above [rough] instructions.

Another attempt at sending an email showed there was a valid key but that the time on this server was ahead by some 6 minutes.  I then found that NTP hadn’t been enabled and so had to enable this in order to get the time aligned with other servers on the Internet.

My last test email, was a complete success.  The headers showed that everything was as it should be.  The DKIM signature had been accepted.

The next thing I need to read up on and implement for the domain in question is dmarc.  But more on that later.

Reference material

Courier MTA and DKIM

Image credit:  Thanks to Jake Rush for uploading the featured image GotCredit to flickr.com.

8 Replies to “DKIM + Courier-MTA on CentOS7”

  1. I believe your instructions for setting up the DKIM DNS TXT file should say ‘everything in the .txt file up to AND INCLUDING the last “)”’, yes?

    1. Hey, Nothing like making sure the instructions are crystal clear! 😉

      I’ve taken on board your suggestion and added the words “and including” to make sure there is no confusion.

      Thanks for taking the time to visit, and even more so, for helping me to improve the quality of the information I post.

      1. DKIM is confusing and complicated enough as it is 🙂 Syntactical and lexical precision helps. A little research turned up the fact that enclosing parentheses are a legal DNS TXT record format, however, unfortunately, the DKIM validator at https://dmarcian.com/dkim-inspector/ won’t validate it! Go figure.

  2. A couple more points on your (otherwise excellent) documentation, and an FYI observation:

    Under “A word of warning”, end of paragraph, you refer to “the separator name”. I believe you mean “the selector name”.

    Also, in the code just below this, you have:

    ln -s tobyheywood tobyheywood.com

    In the version of opendkim-genkey which I have here (v2.9.1) the private key is suffixed with “.private, so the above should probably be:

    ln -s tobyheywood.private tobyheywood.com

    This is also the behavior in opedkim-genkey v2.10.3, distributed with Ubuntu 16.04 LTS (the latest LTS version)

    Finally, after running my own DNS server for years and maintaining my own zone files, I’m using the DNS at Linode via their web-GUI, since this is where my server lives. Entering the public key TXT file, as generated by opendkim-genkey, verbatum into this UI results in a key that won’t validate with Gmail. This is possibly an issue with Linode’s DNS management UI which inserts a /009 [sic] between key strings when returning the key in response to a query. Linode is a popular cloud hosting environment and a lot of people use their DNS, so a word of caution about using this string verbatum in ANY web-GUI DNS management system might be in order. After stripping the parentheses and extraneous quotes from the multi-line TXT string the resulting record passed muster with Gmail, and also with https://dmarcian.com/dkim-inspector.

    Comprehensive, current online documentation on setting up zdkimfilter with Courier is pretty hard to come by, and your documentation is possibly more important than you may realize! Thanks for making it available.

    1. Another good find! Yup, having looked back at how the files are generated, the private key files created by opendkim-keygen are indeed created with a suffix of .private.

      I’ll update that too!

      Thanks for the kind words! 🙂

  3. Also:

    Your code …

    opendkim-genkey -b 2048 -d tobyheywood.com -D /etc/courier/filters/keys -s tobyheywood -r -nosubdomains -v

    This should be “–nosubdomains” (two dashes) rather than “-nosubdomains”.

    1. Thank you again, for vetting the posting for errors!

      Post updated to reflect the missing “-“. It’s also interesting (maybe) to note that you can achieve the same result using “-S” instead of “–nosubdomains” (obviously without the quotes at either end.

      I’m in two minds as to whether it is better to make the commands as clear as possible for future reference, as –nosubdomains is pretty clear what it means whereas -S wouldd be something I’d have to look up.

      1. I always like to know what’s going on so IMHO long option forms are good, but functionally I just copy and paste so from that point of view it’s a no-never mind as long as the command string is correct.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.