DKIM - Condicional Signing

mailman

My objective is to use Mailcow just has my own private smtp relay to send emails from my websites. So, most of the domains that will send emails using Mailcow are not hosted on Mailcow.

Some domains have their own DKIM, others don’t.

I need Mailcow to act in the following way:

1- If domain is NOT present on MailCow, all emails must be signed using Mailcow hostname default DKIM (mailcow.myserver.com).
2- If domain/dkim IS present on Mailcow, the email is signed by that DKIM (own domain DKIM).

If this possible to do? Any advice or tutorial link on how to do it?
Thanks

esackbauer

mailman My objective is to use Mailcow just has my own private smtp relay

Then mailcow (as a groupware) is a total overkill. A postfix container like this is enough.
It would also allow you the separation, in case you are running domains on mailcow. Mailcow does by default not sign any relayed mails, even if they are present on mailcow.

mailman

esackbauer
I understand what you are saying.. but I have been trying just with postfix and still not get want I need, so I thought to see if with mailcow this would be easy, maybe by just using GUI settings.
The only thing is the DKIM sign as I said on my first message.
Can it be done with Mailcow? Can it be done just with postfix (or that docker image)? How?
Thanks

esackbauer

It can be done with both - mailcow and that postfix container. You need to know how DKIM works. And docker volumes.
Unfortunately both cannot be configured with the GUI for that purpose. The page I linked for that postfix container has DKIM instructions.

mailman

Thanks for the information. But still looking for a guide on specific instruction on Mailcow or Postfix alone stack, on what needs to be changed to sign the dkim as I need.

I think Mailcow uses rspamd to manage and sign DKIM. Maybe that is where I hould look into.
Anyway if anyone know the solution for my issue, please say. I will really appreciate.

Thanks

esackbauer

You could have a look at this:
https://community.mailcow.email/d/3613-dkim-signing-lua-dkim-toolslua195-mail-is-ineligible-for-signing/10
Maybe it works for you (at least for the configured domains in mailcow)

mailman

esackbauer
Thanks again. I will look into that link.

For now Im reading the rspamd docs https://rspamd.com/doc/modules/dkim_signing.html the part where it says:
“The selector and path to the key are selected from the domain-specific configuration, if present. If not, the global configuration is used as a fallback.”

Maybe just defining a dkim signature fallback in rspamd is the solution?