DKIM Signing of Relayed Mail with Amavis + Postfix
It has long been good practice to use email-validation tools such as Sender Protection Framework (SPF) and Domainkeys / DKIM to provide confidence that a given server or domain has the authority to send emails on behalf of its own or other domains. We use Postfix and Amavisd-new on Debian to perform DKIM signing of messages on a central mail server that relays mail for many other servers. There were a couple of catches to getting it all working that I wanted to record for posterity, should anyone else run into similar problems.
First. amavisd-new can now (since version 2.6.0) handle DKIM signing itself, meaning you can do away with additional milters or the use of dkimproxy. To tell amavis that you want it to sign mail, you need only add this line to an appropriate config file (say, conf.d/50-user):
$enable_dkim_signing = 1;
Keys and selectors are assigned to domains by adding lines like so:
dkim_key('example.com', 'selector', '/var/db/dkim/example.com.key.pem');(I am omitting the details of generating keys and creating the DNS records necessary to make DKIM work. There are lots of tutorials on the net that cover that material.)
