Multiple Domains with DKIM

PROBLEM

I want to use multiple DKIM's with multiple domains on my mail server.

ENVIRONMENT

• atmail mail server

CAUSE

The Web admin page only allows one domain with DKIM to be specified.

RESOLUTION

⚠ WARNING
Please note, management of multiple DKIM's will not be accessible from the Web interface. It is however recommended you have DKIM 'ON' and provide details for ONE of your domains to satisfy the web page requirements on the Webadmin->Services->SMTP settings page.

1. Change into the new DKIM directory and create your public and private keys for your domains:
   

   % cd /etc/exim/dkim/

   % openssl genrsa -out example1.com-private.pem 1024 -outform PEM

   % openssl rsa -in example1.com-private.pem -out example1.com.pem -pubout -outform PEM

   % openssl genrsa -out example2.com-private.pem 1024 -outform PEM

   % openssl rsa -in example2.com-private.pem -out example2.com.pem -pubout -outform PEM

   To avoid confusion with the .pem files, create a pub (public keys) directory and move the .com.pems into it.

   % mkdir pub ; mv example1.com.pem example2.com.pem pub/

2. Change ownership of files and directory to atmail
   

   % chown -R exim:exim /etc/exim/dkim/*

3. DKIM requires a TXT record that is to be published in the domains DNS records. A TXT record in regards to DKIM requires two fields: a name/selector field, and a text/value field. A common practice is to use the date for the 'selector' that is associated with the domain.
   
   For example, a selector of mail, used with our example1.com domain, the entry should look like the following:
   

   % mail._domainkey.example1.com

   The TXT record uses the public key you made earlier to populate the 'p=' field. Open your domains public-key file with any editor of your choice. The entire file will look like the following:

    % vim example1.com.pem 

   -----BEGIN PUBLIC KEY-----
   MIGfMA0CGSqGSIb3DQEBAQUAA4GNADCBiQKBgQDecXeuzMCtnWstzeQ3Rtib3Qm4
   7BAtzDuNai+ybuDin7sGzCpa9ukrtWTzRejWwfPWO6UgCaCrM1NqCnt2xt0v6Rrh
   Um1ufHCtpuFAYJ9ubdcxdyo/Xwv2tAa5K748YzuIAI3fio8RFQ3flKJowCsg9wDj
   CSvjUm3NMPfebeR9PwIDAQAB
   -----END PUBLIC KEY-----

   Carefully manually remove the header, footer and any line breaks as the TXT record must be submitted as a single line as per below. 

    % mail._domainkey.example1.com IN TXT "v=DKIM1 k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDi65c5K5Pp7bh/T7icab1v0fLQ7sfqNVWezBqhgljfVbH3Nn6nhVW+1l4tAPJUmSssssqFfL+Nx8D1YsPdzralcoMLp0Y3zRLCRBJ9dfgnBJmMwCp+IBW8MjGZa11OV8nIUBp0goG0NDS4UTDmtmecRRS0eWer3fA03ooRQgXRpwIDAQAB"

4. Update your domains DNS records.

5. Verify your DNS TXT record is working using the following: https://www.mail-tester.com/spf-dkim-check

6. Restart exim services for the configuration to take affect.
   

   % systemctl restart exim

7. To test DKIM, send an email and verify by inspecting the headers.