DKIM Problems

BusterB

mail-tester.com used to give me 10/10 previously, but after several mailcow and system upgrades it’s now saying that my DKIM is invalid. I deleted my 1024 DKIM and created (with the mailcow interface) a new 2048 DKIM. I then updated my DNS, waited a few hours (after I confirmed the DNS propogated) and I still get the followiing:

Your DKIM signature is not valid
DomainKeys Identified Mail (DKIM) is a method for associating a domain name to an email message, thereby allowing a person, role, or organization to claim some responsibility for the message.

The DKIM signature of your message is:

	v=1;
	a=rsa-sha256;
	c=relaxed/relaxed;
	d=beckernet.ca;
	s=dkim;
	t=1654091931;
	h=from:subject:date:message-id:to:mime-version:content-type;
	bh=RcckKLYmoCxdwHQosyFWYTBzyasfasfa4H/4NFVBHeKKBBnsUU=;
	b=<I SNIPPED THIS>

Your public key is:

"v=DKIM1;
k=rsa;
t=s;
s=email;
p=<I SNIPPED THIS ALSO>

Your DKIM signature is not valid

Any ideas? I tried several combinations of DKIM public/private keys but it seems that what’s in the mailcow GUI and DNS seem to get altered somewhere within Mailcow containers. Any ideas on how to manually reset this and get this to work?

Thanks,
Buster

BusterB

Update: So after several hours and multiple DNS/DKIM updates, I found that DKIM was fine with SOGo and other IMAP hosts, but fails for Roundcube. I used the recommeded mailcow config settings here, and mail sends and receives fine, but without any DKIM signing. I’m at a loss to figure out where to make the change at this point. I’ve tried replacing the generic ‘tls://postfix’ with ‘tls://IP.IP.IP.IP’ and ‘tls://domainname.com’ for the host but nothing. Do we need to refer to a DKIM .PHP file somewhere?

Thoughts?

diekuh

There are several reasons your setup can be broken.

Leave docker-compose logs --tail=1 -f rspamd-mailcow running, send a mail in Roundcube and check the logged output, please. 🙂

I’m more often to be found on Telegram, might take me a while to read the response.

BusterB

Sorry for the late reply. Here is my output (raw).

Attaching to mailcowdockerized_rspamd-mailcow_1 [36mrspamd-mailcow_1 | [0m 2022-06-19 09:25:23 #38(controller) <762569>; csession; rspamd_protocol_http_reply: regexp statistics: 0 pcre regexps scanned, 0 regexps matched, 3240 regexps total, 2434 regexps cached, 0B scanned using pcre, 102B scanned total [36mrspamd-mailcow_1 | [0m 2022-06-19 09:26:03 #39(normal) <498f59>; task; rspamd_task_write_log: id: <a8e64a594f4588f9e077eb247372e48a@mydomain.ca>, qid: <B3BC4B1085A>, ip: 172.22.1.8, user: buster@mydomain.ca, from: <buster@mydomain.ca>, (default: F (no action): [-20.10/11.00] [MAILCOW_AUTH(-20.00){},MIME_GOOD(-0.10){multipart/alternative;text/plain;},ARC_NA(0.00){},BCC(0.00){},DBL_BLOCKED_OPENRESOLVER(0.00){mailcowdockerized_php-fpm-mailcow_1.mailcowdockerized_mailcow-network:rdns;},DKIM_SIGNED(0.00){mydomain.ca:s=dkim;},DYN_RL_CHECK(0.00){},FREEMAIL_ENVRCPT(0.00){hotmail.com;},FREEMAIL_TO(0.00){hotmail.com;},FROM_EQ_ENVFROM(0.00){},FROM_NO_DN(0.00){},MAILCOW_DOMAIN_HEADER_FROM(0.00){mydomain.ca;},MID_RHS_MATCH_FROM(0.00){},MIME_TRACE(0.00){0:+;1:+;2:~;},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_ZERO(0.00){0;},R_PARTS_DIFFER(0.00){50.0%;},TO_DN_ALL(0.00){},TO_MATCH_ENVRCPT_ALL(0.00){}]), len: 865, time: 231.901ms, dns req: 6, digest: <14ceeab258933e6a9baff7c57406b958>, rcpts: <myhotmail@hotmail.com>, mime_rcpts: <myhotmail@hotmail.com> [36mrspamd-mailcow_1 | [0m 2022-06-19 09:26:03 #39(normal) <498f59>; task; rspamd_protocol_http_reply: regexp statistics: 0 pcre regexps scanned, 2 regexps matched, 3240 regexps total, 2940 regexps cached, 0B scanned using pcre, 865B scanned total

That “MAILCOW_AUTH(-20.00)” doesn’t look right. Could that be the reason?

Thanks for your help, Diekuh.