Hello
post your
signconf.xml
Regards
On 6/22/24 18:52, Jeff Koch wrote:
Hi:
We must be doing something wrong. Maybe one of you can help. No matter
how we setup the contents of signconf.xml we can't get qmail-remote to
sign emails with anything other than the mailserver's name unless we
specify each domain in a separate stanza of the xml file.
For example: If we use a signconf.xml file with just the global stanza
as in:
<dkimsign>
<!-- per default sign all mails using dkim -->
<global algorithm="rsa-sha1" domain="/var/qmail/control/me"
keyfile="/var/qmail/control/dkim/global.key" method="simple"
selector="dkim1">
<types id="dkim" />
</global>
</dkimsign>
and then sign an email from say 'j...@domain1.com' and send that email
to a gmail account. Gmail's dkim analysis shows:
---------------
DKIM-Signature: v=1; a=rsa-sha1; c=simple; d=mymailserver.com; h=
message-id:date:subject:from:to:mime-version:content-type
:content-transfer-encoding; s=dkim1;
-------------------
and it pulls the dkim dns record from 'mymailserver.com' based on the
'd' attribute to verify the signature.
But what we really want is for the dkim signature to show
'd=domain1.com' so that gmail uses the dkim record in domain1.com's
DNS record and the only way we've been able to make that happen is to
have a separate signconf.xml stanza for 'domain1.com' like:
<domain1.com domain="domain1.com"
keyfile="/var/qmail/control/dkim/some.key" selector="dkim1">
<types id="dkim" />
<types id="domainkey" method="nofws" />
</domain1.com>
Somehow qmail-remote should be extracting sending domain name from
'from address' and using that in the 'd' attribute when signing the
email. But it's not doing that for us.
Jeff
