Setting Up DKIM with Exim

Create a Directory for Keys

Choose a directory to store DKIM keys, such as /etc/exim/dkim/:

sudo mkdir -p /etc/exim/dkim
sudo chmod 700 /etc/exim/dkim

Generate a DKIM Key Pair

Replace default with the selector you want to use:

openssl genrsa -out /etc/exim/dkim/default.private 2048
openssl rsa -in /etc/exim/dkim/default.private -pubout -out /etc/exim/dkim/default.public

Set Permissions

Restrict access to the private key:

sudo chmod 600 /etc/exim/dkim/default.private

Extract the Public Key

Format the public key for the DNS record:

awk 'NR > 1 && NR < 10' /etc/exim/dkim/default.public | tr -d '\n' > /etc/exim/dkim/default.txt

The output is the key you will add to your DNS.

Add a TXT Record

Use the following format to create a TXT record in your DNS settings:

default._domainkey.example.com IN TXT "v=DKIM1; k=rsa; p=PUBLIC_KEY"

Replace:

• default with the selector you chose.
• example.com with your domain.
• PUBLIC_KEY with the content from /etc/exim/dkim/default.txt.

Verify DNS Propagation

Check the DKIM record using:

dig TXT default._domainkey.example.com

Edit Exim Configuration

Open the Exim configuration file (/etc/exim/exim.conf or /etc/exim4/exim4.conf):

sudo nano /etc/exim/exim.conf

Add DKIM Settings

Add the following to the configuration:

# DKIM Settings

dkim_domain = ${sender_address_domain}

dkim_selector = default

dkim_private_key = /etc/exim/dkim/default.private

dkim_canon = relaxed

dkim_strict = false

This tells Exim to:

• Use the sender domain for DKIM signing.
• Use the default selector.
• Load the private key from /etc/exim/dkim/default.private.

Save and Exit

Save the file and exit (Ctrl+O, Ctrl+X).

Restart Exim

Apply the changes by restarting Exim:

sudo systemctl restart exim