I'm trying to weigh up whether DKIM signing should be done by the application sending mail (for instance, the mailing list software you're using) or at the mail transfer agent (sendmail, postfix etc).
Do you know any good arguments either way?
As far as I can see, doing it at the MTA, such as with dkim-milter, is a lot easier to set up.
However, if anyone gets access to the server, even just a normal unprivileged account such as a web hosting client's login, they'd be able to send email using sendmail and get the full blessing of my DKIM signature.
What do you think is the best solution for my situation? I'm using a Debian server with apache, postfix, php&mysql, etc.
I believe the MTA is the appropriate and sensible place and a whole lot easier to implement and maintain. Why would you want the headaches of trying to do this on every client, even if that client is capable of it?
I run ours at the MTA level on our Windows SMTP server with this product.
This was much easier for us to setup as well.
My attitude is is to protect the SMTP server with other protection measures (firewall, network segmentation, acl's, etc). If someone does get to that server then the least of my concerns is if SPAM is being sent out -- my server has already been owned by someone else :)
The DKIM signatures usually contain headers only the MTA would know about: eg; Message-ID and Received.