dkim questions - Page 1

Aleksandar Pavić

Asked: 2020-08-02 23:07:15 +0800 CST

Opendkim installation on Ubuntu Server 18.04 failing

1

After installing virtualmin, opendkim installation (apt install opendkim opendkim-tools) fails in a following way:

Do you want to continue? [Y/n] 
Setting up opendkim (2.11.0~alpha-11build1) ...
Job for opendkim.service failed because a timeout was exceeded.
See "systemctl status opendkim.service" and "journalctl -xe" for details.
invoke-rc.d: initscript opendkim, action "start" failed.
● opendkim.service - OpenDKIM DomainKeys Identified Mail (DKIM) Milter
   Loaded: loaded (/lib/systemd/system/opendkim.service; enabled; vendor preset: enabled)
   Active: activating (auto-restart) (Result: timeout) since Sun 2020-08-02 09:45:05 EEST; 9ms ago
     Docs: man:opendkim(8)
           man:opendkim.conf(5)
           man:opendkim-genkey(8)
           man:opendkim-genzone(8)
           man:opendkim-testadsp(8)
           man:opendkim-testkey
           http://www.opendkim.org/docs.html
dpkg: error processing package opendkim (--configure):
 installed opendkim package post-installation script subprocess returned error exit status 1
Errors were encountered while processing:
 opendkim
E: Sub-process /usr/bin/dpkg returned an error code (1)

CatchAsCatchCan

Asked: 2019-03-21 12:13:18 +0800 CST

DKIM failure 'body hash did not verify', but only on CRON output

3

I have successfully installed Postfix and OpenDkim on my server, and it's correctly signing mail from several different domains. The host we'll call webhost.example.com. It's running Ubuntu 18.04.2 LTS, Postfix 3.3.0 and OpenDKIM v2.11.0

Today I wanted to get output from some CRON jobs sent to my Gmail account so I set up the required entries in the KeyTable and SigningTable and generated the keys and tested it with a one line email to myself.

echo "Test message" | mail -s "Test message" [email protected]

This should generate an email from [email protected]. It does, correctly signed by OpenDKIM, and delivered to my Gmail account where it successfully passes validation.

Here's what I get at GMail:

Delivered-To: [email protected]
Received: by 2002:a5d:48c4:0:0:0:0:0 with SMTP id p4csp257074wrs;
        Tue, 19 Mar 2019 21:00:38 -0700 (PDT)
X-Google-Smtp-Source: APXvYqzzFOWDKe9HXwsYXMKgDAYZjyoHVQj0EcFTzj7zrlnhiY0QBCN2DaEXqiXjh8T71ZiLDzqc
X-Received: by 2002:a62:5789:: with SMTP id i9mr27645136pfj.75.1553054437831;
        Tue, 19 Mar 2019 21:00:37 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1553054437; cv=none;
        d=google.com; s=arc-20160816;
        b=bBqJW5ba0CKQdhBlKSOmx8A+D++aHf/NwbCWSD5V0Mq/+E2NSAwtSU9Yi/sOpp0dAl
         VZ2fbB1PNjhB1KGTT2vwoOambDbYUwWB2nIMG5w3aFlUVoOFgYLmLFZwHx6EeTm+nKbQ
         tu6XzdsjT0Vl9HtH44hXed4WU5eRe4KGcblkKSswF3xQ3k57PPOSOea0qdqSN+K3Usj1
         yv9B81pxTRKdBa3Ihkxmy6q0BPfiwwVRD1rb22/swhC/QS7O7M/9AKGxlxBhl1zgks9a
         55Sm1ghGyN3HFoDlZ8bWNo0qImV4bQPsDaTVDykueHOxC2tXBdxA8559io4QKwBU2yc1
         TFFA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=from:date:message-id:to:subject:dkim-signature;
        bh=vMryiu7Ey0Nro6WC0HJ1+2DMJ4hQ10+LmaSady45MSs=;
        b=RN6/AsO7ejyBlwkSuPyLIgktIttKp2ar60+D0vyf4Le/RP543qL/OQUSC5su1tbc7l
         fbEaCSnDuuBpB0OlJiBjQHeu0y3+FvK4cjmElRgPMyMFbk3q6PxbEXLrgeKs9tiKFHSG
         TFAu+Czb32yhOVgmJQNwQ4cpyOKEZmfz7eXFwXBvw69D4qGUrW6q7j54xoQGl8kTVDM5
         kUz/N4JoiS9rAFNxft/fg0druQaoMCFhuPR8d5a7NYJBp3vV+bWyonLD2kGbqxFujU97
         RjAMko+eMvuWS7zWOnqYF3Di3MyGDLBlue4+rXz65o0VxrTS/MZhsKZFG/LzlBdi4vPF
         0thA==
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass [email protected] header.s=webhost header.b=eMU0P6hB;
       spf=pass (google.com: domain of [email protected] designates 13.238.180.128 as permitted sender) [email protected];
       dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=example.com
Return-Path: <[email protected]>
Received: from webhost.example.com (ec2-13-238-180-128.ap-southeast-2.compute.amazonaws.com. [13.238.180.128])
        by mx.google.com with ESMTP id j134si770928pgc.42.2019.03.19.21.00.37
        for <[email protected]>;
        Tue, 19 Mar 2019 21:00:37 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 13.238.180.128 as permitted sender) client-ip=13.238.180.128;
Authentication-Results: mx.google.com;
       dkim=pass [email protected] header.s=webhost header.b=eMU0P6hB;
       spf=pass (google.com: domain of [email protected] designates 13.238.180.128 as permitted sender) [email protected];
       dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=example.com
Received: by webhost.example.com (Postfix, from userid 1000)
    id 3E9A8FA106; Wed, 20 Mar 2019 04:00:36 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;
    d=webhost.example.com; s=webhost; t=1553054436;
    bh=vMryiu7Ey0Nro6WC0HJ1+2DMJ4hQ10+LmaSady45MSs=;
    h=Subject:To:Date:From:From;
    b=eMU0P6hBtTMDVSU5aw1dTR7CSlrBSHjK4And4uaFeo+HnSnD5+bBAKObTk3WxeLgr
     Tf/1/httpjXNUdphU5STlFSqeunuZJafxDqLVzuoYHJOCuQ8vfGoZqyI2hGaJ9ql8E
     dSp1j1mOVRBYC8KpSYbnA+Uc2+ut68mQDDRc2pZQWdQLzmxWwCiz+tAAXdHQFVsx+D
     sobOHN/cq9CgJNkEs0qnjsE9zdnTdMrO+1AbnJBCHKeQBZAoDdg4OjjlMmg4kTmLli
     fyVtcYBHaY8OjM15qiKL0YvjzfnCP50L7VjT9EBAhtJn2d9lYGyhQ/sLbwx91nL/yG
     OTxMRE82pD6wQ==
Subject: This is a test message
To: <[email protected]>
X-Mailer: mail (GNU Mailutils 3.4)
Message-Id: <[email protected]>
Date: Wed, 20 Mar 2019 04:00:36 +0000 (UTC)
From: Ubuntu <[email protected]>

This is a test message. You know the drill!

So far, so good.

I set up my cron jobs and add the line

[email protected]

The output is generated, signed and mailed, but GMail fails the DKIM validation with

dkim=neutral (body hash did not verify) [email protected] header.s=webhost header.b=tXJM8ih0;

Here's the complete email. If it's useful this is output from a curl request.

Delivered-To: [email protected]
Received: by 2002:a5d:48c4:0:0:0:0:0 with SMTP id p4csp776152wrs;
        Wed, 20 Mar 2019 07:14:04 -0700 (PDT)
X-Google-Smtp-Source: APXvYqyZdMJuwpApjkjfxfh/rsHg67hLBtQSS5j0BUCq8NaaxUqV+sIDf7CPy+sYjS2b817v9pAu
X-Received: by 2002:a63:5541:: with SMTP id f1mr7627593pgm.38.1553091244323;
        Wed, 20 Mar 2019 07:14:04 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1553091244; cv=none;
        d=google.com; s=arc-20160816;
        b=h3SPkfLIm9BjWS+SlJc4Wd/8XFE2YT3QNSOkzzLY858wldyOXMn3OR8rFcU6UVmbEL
         stCPHuXM7ouP0s7ICTC4TAyv+DiqWNokBsRkwXjdP6+mEEmXlP6VUk8H/+nL89BrMp4E
         FhzVM4sE5/3VphjuXPom0Ux+e+WrLDWBZbKMbMOLSMkbmCL6B3/llK3FMwPfAGPzS2O8
         o+cfm6r15W0aND02eIvNg6px2kNmD+wHAI993/BZJ3vIPvNzsEHFUWwbD10iYkIUwmvA
         DMUVB3jx+pXtFhv17+Fpx0zsSx5806vieOVoLxXAnlJgdykNH/DuZY3NM1DVyR1Renxw
         eTPg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=date:message-id:content-transfer-encoding:mime-version:subject:to
         :from:dkim-signature;
        bh=lkMik4Dz2hOPxvMLwTHlE8QE1l4G/X7DcjAYikPMEMc=;
        b=N85+olM3406vk7LhpV03QNxCZQLELh+ZLjUIUg1xt5u7z/aJZS0CRa1q4JJcBn8Fm0
         nRBvMLFJXIrm0Y11s5kET6Xvzkk9G/szfJNqthy7e80mHs2Q7xgfYeVpYmQmL3DxjVjm
         mzlnJVzVyx0XLMcAKaneb0CkOIsuOo6nkCGMakPsS9e+vMpfdnBggZZQv1zqkGHzTnML
         +QMIVMEH7kgQphYo6GiCVb1LWThuwYyI+nSclPDw9fNLRPGTNqbiBqWQuEdgM3/K46Zy
         gY4SgTXwL+MOCVgIbN33ZG3FuVHwyr5bQZGrpR48HXS68zYA5jbcgF9eFDBtuBOQPDo+
         HkKw==
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=neutral (body hash did not verify) [email protected] header.s=webhost header.b=tXJM8ih0;
       spf=pass (google.com: domain of [email protected] designates 13.238.180.128 as permitted sender) [email protected];
       dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=example.com
Return-Path: <[email protected]>
Received: from webhost.example.com (ec2-13-238-180-128.ap-southeast-2.compute.amazonaws.com. [13.238.180.128])
        by mx.google.com with ESMTP id b7si1705816pgl.20.2019.03.20.07.14.03
        for <[email protected]>;
        Wed, 20 Mar 2019 07:14:04 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 13.238.180.128 as permitted sender) client-ip=13.238.180.128;
Authentication-Results: mx.google.com;
       dkim=neutral (body hash did not verify) [email protected] header.s=webhost header.b=tXJM8ih0;
       spf=pass (google.com: domain of [email protected] designates 13.238.180.128 as permitted sender) [email protected];
       dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=example.com
Received: by webhost.example.com (Postfix, from userid 1000)
    id 0FACCFA104; Wed, 20 Mar 2019 14:14:02 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;
    d=webhost.example.com; s=webhost; t=1553091242;
    bh=20rEKrmO1yPqlIJwX4HLsjr/kx4SaM/AaK17/OmPhLA=;
    h=From:To:Subject:Date:From;
    b=tXJM8ih006AjxwXJNAD30k7Fjo/HYTsi5bEfOCaxr0D8BiEAA/mIiDvaexjHPWNQ6
     B5DrCGlhvLVZIRs1Zp2v4pbYYYvpmrzOTB99vXk0lEEGTRIwdhvAYKT31Jt2N5VMq3
     hifps7hj3TD/Eevks82VvcIu2xJWXFPNEZMGvjcRa3hFSE2IIcfOhMJhwX5Rcnx+F4
     wjtxqROgxXpHxgJkXzkVe3HbpKVK5eOrsBoeRnUhR4SWa2f7UKhT4k28KOuTQo8bG3
     E63PoPwcOQU4cPiiqnPEdWO7ERvSHetgh/1yjpigcbch9SWwQHwA4FPSmcfOfLeIov
     +wxrbVKHXtzMA==
From: [email protected] (Cron Daemon)
To: [email protected]
Subject: Cron <ubuntu@webhost> curl https://invoicing2018.example.com/tasks/run
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Cron-Env: <[email protected]>
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/home/ubuntu>
X-Cron-Env: <PATH=/usr/bin:/bin>
X-Cron-Env: <LOGNAME=ubuntu>
Message-Id: <[email protected]>
Date: Wed, 20 Mar 2019 14:14:02 +0000 (UTC)

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0

The emails from cron also fail the Port25 verifier in the same way

So, the question is:

Why does my DKIM configuration correctly sign everything but output from CRON?

What can I do to fix this?

I could try using a script to run the curl request and send the email with mail, but I have a number of other cron jobs to add yet and I'd rather fix the underlying problem before trying work-arounds.

Hack Saw

Asked: 2019-02-12 02:13:42 +0800 CST

Opendkim won't start: can't open PID file?

10

This is the complaint I get from systemd:

"opendkim.service: Can't open PID file /var/run/opendkim/opendkim.pid"

As seen here:

systemctl status opendkim.service

puts out this:

● opendkim.service - OpenDKIM DomainKeys Identified Mail (DKIM) Milter
   Loaded: loaded (/lib/systemd/system/opendkim.service; enabled; vendor preset: enabled)
   Active: deactivating (stop-sigterm) (Result: timeout)
     Docs: man:opendkim(8)
           man:opendkim.conf(5)
           man:opendkim-genkey(8)
           man:opendkim-genzone(8)
           man:opendkim-testadsp(8)
           man:opendkim-testkey
           http://www.opendkim.org/docs.html
  Process: 8217 ExecStart=/usr/sbin/opendkim -x /etc/opendkim.conf (code=exited, status=0/SUCCESS)
    Tasks: 6 (limit: 2361)
   CGroup: /system.slice/opendkim.service
           └─8226 /usr/sbin/opendkim -x /etc/opendkim.conf

Feb 11 04:56:48 hacksaw.org systemd[1]: Starting OpenDKIM DomainKeys Identified Mail (DKIM) Milter...
Feb 11 04:56:48 hacksaw.org systemd[1]: opendkim.service: Can't open PID file /var/run/opendkim/opendkim.pid (yet?) after start: No such file or directory
Feb 11 04:56:48 hacksaw.org opendkim[8226]: OpenDKIM Filter v2.11.0 starting (args: -x /etc/opendkim.conf)
Feb 11 04:58:18 hacksaw.org systemd[1]: opendkim.service: Start operation timed out. Terminating.

If I start the daemon by hand, it goes. This seems to be about systemd.

Other data:

#ls -ld /var/run/opendkim/
drwxr-xr-x 2 opendkim opendkim 40 Feb 11 04:25 /var/run/opendkim/

The only line on the opendkim.conf:

UserID      opendkim:opendkim

The default opendkim service file, from /lib/systemd/service:

[Unit]
Description=OpenDKIM DomainKeys Identified Mail (DKIM) Milter
Documentation=man:opendkim(8) man:opendkim.conf(5) man:opendkim-genkey(8) man:opendkim-genzone(8) man:opendkim-testadsp(8) man:opendkim-testkey http://www.opendkim.org/docs.html
After=network.target nss-lookup.target

[Service]
Type=forking
PIDFile=/var/run/opendkim/opendkim.pid
UMask=0007
ExecStart=/usr/sbin/opendkim -x /etc/opendkim.conf
Restart=on-failure
ExecReload=/bin/kill -USR1 $MAINPID

[Install]
WantedBy=multi-user.target

MountainX

Asked: 2012-05-10 18:02:01 +0800 CST

Setup DKIM (DomainKeys) for Ubuntu, Postfix and Mailman

23

I'm running Ubuntu 12.04 with Postfix and Mailman. I want to set up DKIM. DomainKeys Identified Mail, or DKIM, is the successor to Yahoo's "DomainKeys". It incorporates Cisco's Identified Mail.

What are the steps for setting this up?

Is opendkim recommended?

The only reference I have is HowToForge, but I prefer to get help here (even if it is just a confirmation of the steps at that link). Actually, I think the info at HowToForge is outdated because it mentions dkim-filter instead of opendkim.

Dustin Kirkland

Asked: 2012-03-28 13:51:52 +0800 CST

What package replaces dkim-filter in 12.04?

2

Previously, I was using the dkim-filter package in Ubuntu 10.04 LTS for DKIM.

That package is no longer in Ubuntu 12.04 LTS. What's the replacement or alternative?

opendkim, maybe?

Opendkim installation on Ubuntu Server 18.04 failing

DKIM failure 'body hash did not verify', but only on CRON output

Opendkim won't start: can't open PID file?

Setup DKIM (DomainKeys) for Ubuntu, Postfix and Mailman

What package replaces dkim-filter in 12.04?

How to install Google Chrome

Is there a command to list all users? Also to add, delete, modify users, in the terminal?

How to delete a non-empty directory in Terminal?

How to unzip a zip file from the Terminal?

How can I copy the contents of a folder to another folder in a different directory using terminal?

How do I install a .deb file via the command line?

How do I run .sh scripts?

How do I install a .tar.gz (or .tar.bz2) file?

How to list all installed packages

Unable to lock the administration directory (/var/lib/dpkg/) is another process using it?

Questions[dkim](ubuntu)