Configuring DKIM (DomainKeys Identified Mail) in Exim ensures that outgoing emails are signed with a digital signature to verify the authenticity of the sender. Here is a step-by-step guide to setting up DKIM with Exim.

Prerequisites

Before you begin:

  1. Exim Installed:
    • Ensure Exim is installed and running on your server.
    • Use the following command to check its status:
      • systemctl status exim
  2. Access to Server and DNS:
    • SSH access to your server.
    • Control over your DNS settings to publish DKIM public keys.
  3. Install OpenSSL:
    • OpenSSL is required to generate DKIM keys:
      • sudo apt install openssl

Generate DKIM Keys

1

Create a Directory for Keys

Choose a directory to store DKIM keys, such as /etc/exim/dkim/:

sudo mkdir -p /etc/exim/dkim
sudo chmod 700 /etc/exim/dkim
2

Generate a DKIM Key Pair

Replace default with the selector you want to use:

openssl genrsa -out /etc/exim/dkim/default.private 2048
openssl rsa -in /etc/exim/dkim/default.private -pubout -out /etc/exim/dkim/default.public
3

Set Permissions

Restrict access to the private key:

sudo chmod 600 /etc/exim/dkim/default.private
4

Extract the Public Key

Format the public key for the DNS record:

awk 'NR > 1 && NR < 10' /etc/exim/dkim/default.public | tr -d '\n' > /etc/exim/dkim/default.txt

The output is the key you will add to your DNS.

Configure DNS for DKIM

1

Add a TXT Record

Use the following format to create a TXT record in your DNS settings:

default._domainkey.example.com IN TXT "v=DKIM1; k=rsa; p=PUBLIC_KEY"

Replace:

  • default with the selector you chose.
  • example.com with your domain.
  • PUBLIC_KEY with the content from /etc/exim/dkim/default.txt.
2

Verify DNS Propagation

Check the DKIM record using:

dig TXT default._domainkey.example.com

Configure Exim for DKIM

1

Edit Exim Configuration

Open the Exim configuration file (/etc/exim/exim.conf or /etc/exim4/exim4.conf):

sudo nano /etc/exim/exim.conf
2

Add DKIM Settings

Add the following to the configuration:

# DKIM Settings
dkim_domain = ${sender_address_domain}
dkim_selector = default
dkim_private_key = /etc/exim/dkim/default.private
dkim_canon = relaxed
dkim_strict = false

This tells Exim to:

  • Use the sender domain for DKIM signing.
  • Use the default selector.
  • Load the private key from /etc/exim/dkim/default.private.
3

Save and Exit

Save the file and exit (Ctrl+O, Ctrl+X).

4

Restart Exim

Apply the changes by restarting Exim:

sudo systemctl restart exim

Test DKIM Configuration

  1. Send a Test Email:
    • Send an email to a DKIM testing service like:
    • check-auth@verifier.port25.com
    • mail-tester.com
  2. Check Headers:
    • Look for the DKIM-Signature header in the email.
    • A successful DKIM signature should appear as:
    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=default;
  3. Review the DKIM Result:
    • The test report will indicate if the DKIM check passed.

Troubleshooting

Issue Solution
No DKIM-Signature Header
  • Verify Exim logs for errors:
    • sudo tail -f /var/log/exim4/mainlog
  • Check if the dkim_private_key path is correct.
DKIM Validation Fails
  • Ensure the public key is correctly added to the DNS TXT record.
  • Check for formatting issues: no extra spaces or line breaks in the p= value.
  • Verify DNS propagation using:
    • dig TXT default._domainkey.example.com
Emails Flagged as Spam
  • Ensure SPF and DMARC are also configured:
  • SPF Record:
    • v=spf1 mx include:yourmailserver.com -all
  • DMARC Record:
    • _dmarc.example.com IN TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

With DKIM configured, your emails will now include a digital signature that improves email authentication and deliverability. Combine DKIM with SPF and DMARC for robust email security.