DKIM configuratie postfix/CentOS

[ScuL]

Hi

Ik ben nu al een paar uurtjes zoet met het opzetten van DKIM.

Heb de volgende guide gevolgd:
http://www.rosehosting.co...ostfix-on-a-centos-6-vps/

Het filter draait en is ook actief in de maillog echter als ik een test uit voer via
[e-mail]

Dan krijg ik als resultaat:

code:

This message is an automatic response from Port25's authentication verifier service at verifier.port25.com.  The service allows email senders to perform a simple check of various sender authentication mechanisms.  It is provided free of charge, in the hope that it is useful to the email community.  While it is not officially supported, we welcome any feedback you may have at <[e-mail]>.

Thank you for using the verifier,

The Port25 Solutions, Inc. team

==========================================================
Summary of Results
==========================================================
SPF check:          pass
DomainKeys check:   neutral
DKIM check:         permerror
Sender-ID check:    pass
SpamAssassin check: ham

==========================================================
Details:
==========================================================

HELO hostname:  adm.scul.net
Source IP:      85.17.136.101
mail-from:      [e-mail]

----------------------------------------------------------
SPF check details:
----------------------------------------------------------
Result:         pass 
ID(s) verified: smtp.mailfrom=[e-mail] DNS record(s):
    promods.net. SPF (no records)
    promods.net. 3600 IN TXT "v=spf1 a mx ~all"
    promods.net. 1800 IN A 85.17.136.101

----------------------------------------------------------
DomainKeys check details:
----------------------------------------------------------
Result:         neutral (message not signed)
ID(s) verified: header.From=[e-mail] DNS record(s):

----------------------------------------------------------
DKIM check details:
----------------------------------------------------------
Result:         permerror (syntax error in key record: Parse error: no '=' found after tag """)
ID(s) verified: 
Canonicalized Headers:
    date:Wed,'20'23'20'Apr'20'2014'20'17:04:57'20'+0200'20'(CEST)'0D''0A'
    from:[e-mail]'0D''0A'
    dkim-signature:v=1;'20'a=rsa-sha256;'20'c=relaxed/simple;'20'd=scul.net;'20's=default;'20't=1398265513;'20'bh=B9UO+Kyg8QHet+a+iQEhx/le+/LLwThxv+HKt/wFHQY=;'20'h=Date:From;'20'b=

Canonicalized Body:
    Send'20'me'20'a'20'test'0D''0A'
    

DNS record(s):
    default._domainkey.scul.net. 3600 IN TXT "v=DKIM1; k=rsa; "           "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCZ6r0mxc8N2Nf0Mp2k4c6btKhRm+J40TRaQZPqAaYhnHolvPreaaMchrZY8JC1wTfpMo6AgH3wv5MR7TGq5NfeenFF2vMT3e6CxC81rRZvraZ0HMDnltUHBxjzhPD9xPRRSeZIYgmCBZGWI17icgGga0Xt0IDteaFKmzKMZMOWHQIDAQAB"

NOTE: DKIM checking has been performed based on the latest DKIM specs (RFC 4871 or draft-ietf-dkim-base-10) and verification may fail for older versions.  If you are using Port25's PowerMTA, you need to use version 3.2r11 or later to get a compatible version of DKIM.

----------------------------------------------------------
Sender-ID check details:
----------------------------------------------------------
Result:         pass 
ID(s) verified: header.From=[e-mail] DNS record(s):
    promods.net. SPF (no records)
    promods.net. 3600 IN TXT "v=spf1 a mx ~all"
    promods.net. 1800 IN A 85.17.136.101

----------------------------------------------------------
SpamAssassin check details:
----------------------------------------------------------
SpamAssassin v3.3.1 (2010-03-16)

Result:         ham  (1.0 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 1.0 MISSING_HEADERS        Missing To: header
-1.9 BAYES_00               BODY: Bayes spam probability is 0 to 1%
                            [score: 0.0000]
 0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily valid
 1.8 MISSING_SUBJECT        Missing Subject: header

==========================================================
Explanation of the possible results (from RFC 5451) ==========================================================

SPF and Sender-ID Results
=========================

"none"
      No policy records were published at the sender's DNS domain.

"neutral"
      The sender's ADMD has asserted that it cannot or does not
      want to assert whether or not the sending IP address is authorized
      to send mail using the sender's DNS domain.

"pass"
      The client is authorized by the sender's ADMD to inject or
      relay mail on behalf of the sender's DNS domain.

"policy"
     The client is authorized to inject or relay mail on behalf
      of the sender's DNS domain according to the authentication
      method's algorithm, but local policy dictates that the result is
      unacceptable.

"fail"
      This client is explicitly not authorized to inject or
      relay mail using the sender's DNS domain.

"softfail"
      The sender's ADMD believes the client was not authorized
      to inject or relay mail using the sender's DNS domain, but is
      unwilling to make a strong assertion to that effect.

"temperror"
      The message could not be verified due to some error that
      is likely transient in nature, such as a temporary inability to
      retrieve a policy record from DNS.  A later attempt may produce a
      final result.

"permerror"
      The message could not be verified due to some error that
      is unrecoverable, such as a required header field being absent or
      a syntax error in a retrieved DNS TXT record.  A later attempt is
      unlikely to produce a final result.


DKIM and DomainKeys Results
===========================

"none"
      The message was not signed.

"pass"
      The message was signed, the signature or signatures were
      acceptable to the verifier, and the signature(s) passed
      verification tests.

"fail"
      The message was signed and the signature or signatures were
      acceptable to the verifier, but they failed the verification
      test(s).

"policy"
      The message was signed but the signature or signatures were
      not acceptable to the verifier.

"neutral"
      The message was signed but the signature or signatures
      contained syntax errors or were not otherwise able to be
      processed.  This result SHOULD also be used for other
      failures not covered elsewhere in this list.

"temperror"
      The message could not be verified due to some error that
      is likely transient in nature, such as a temporary inability
      to retrieve a public key.  A later attempt may produce a
      final result.

"permerror"
      The message could not be verified due to some error that
      is unrecoverable, such as a required header field being
      absent. A later attempt is unlikely to produce a final result.


==========================================================
Original Email
==========================================================

Return-Path: <[e-mail]>
Received: from adm.scul.net (85.17.136.101) by verifier.port25.com id havhva11u9cr for <[e-mail]>; Wed, 23 Apr 2014 12:01:57 -0400 (envelope-from <[e-mail]>)
Authentication-Results: verifier.port25.com; spf=pass smtp.mailfrom=[e-mail]
Authentication-Results: verifier.port25.com; domainkeys=neutral (message not signed) header.From=[e-mail]
Authentication-Results: verifier.port25.com; dkim=permerror (syntax error in key record: Parse error: no '=' found after tag """)
Authentication-Results: verifier.port25.com; sender-id=pass header.From=[e-mail]
X-No-Auth: unauthenticated sender
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=scul.net; s=default;
    t=1398265513; bh=B9UO+Kyg8QHet+a+iQEhx/le+/LLwThxv+HKt/wFHQY=;
    h=Date:From;
    b=OECQct3wCfpXWVzDO5I//ZL5gB+Ldl+afwBWZE9ILmN8L/qqt/eRlfUFy21kHJN2v
     RgItmA4OVNnx6ByRfw8VuKTgAVoTRCHJoxqeBiF2gtdX9A/HSohyFzLUiDoBW+ydVr
     t8v7b7E20I8FW6GfxXNAxCTnz2rqOxc4u/aVqktQ=
Received: from promods.net (adm.scul.net [127.0.0.1])
    by adm.scul.net (Postfix) with SMTP id 1A87A18C04F9
    for <[e-mail]>; Wed, 23 Apr 2014 17:04:57 +0200 (CEST)
Message-Id: <[e-mail]>
Date: Wed, 23 Apr 2014 17:04:57 +0200 (CEST)
From: [e-mail]

Send me a test

Ik heb op de server meerdere domeinen draaien (een stuk of 8, 9), van die domeinen sturen er 4 actief e-mail uit. Omdat de server zelf onder m'n nickname valt ( scul.net ) is de mailserver en dus ook het DKIM record als zodanig geconfigureerd.

1) Is het noodzakelijk om DKIM-keys te maken voor de overige 4 domeinen of zou dat niet uit moeten maken en kunnen ze allemaal onder scul.net (omdat het de hoofd server & ook reverse DNS is) ?
2) Staat er wellicht iets fout in m'n DNS record?

[Bastien]

Je hoort voor elk domein een aparte key set te maken. Je moet deze vervolgens ook voor ieder domein apart in een DNS record zetten. Het gaat om het het domein van de afzender (bijvoorbeeld promods.net), niet om het domein van de mailserver (scul.net). Ieder verzendend domein heeft zijn eigen dkim 'handtekening' dus.

[ScuL]

Thanks ik heb het nu per domain gedaan en nu krijg ik een DKIM-pass via diverse testing services, het blijkt dus te werken zo