OpenDKIMをセットアップする方法

[kantaro@cloud ~]$ alternatives --display mta
mta -ステータスは自動です。
リンクは現在 /usr/sbin/sendmail.postfix を指しています。
（略）

[kantaro@cloud ~]$ alternatives --config mta

2 プログラムがあり 'mta' を提供します。

  選択       コマンド
-----------------------------------------------
*+ 1           /usr/sbin/sendmail.sendmail
   2           /usr/sbin/sendmail.postfix

Enter を押して現在の選択 [+] を保持するか、選択番号を入力します:2

rpm -ivh http://ftp.riken.jp/Linux/fedora/epel/6/i386/epel-release-6-8.noarch.rpm

rpm -ivh http://ftp.riken.jp/Linux/fedora/epel/6/x86_64/epel-release-6-8.noarch.rpm

yum install opendkim

cd /etc/opendkim/keys/
mkdir sample.com

cd sample.com
opendkim-genkey -d sample.com -s dkimselector

chown -R opendkim:opendkim /etc/opendkim/keys

## BASIC OPENDKIM CONFIGURATION FILE
## See opendkim.conf(5) or %{_pkgdocdir}/opendkim.conf.sample for more

## BEFORE running OpenDKIM you must:

## - make your MTA (Postfix, Sendmail, etc.) aware of OpenDKIM
## - generate keys for your domain (if signing)
## - edit your DNS records to publish your public keys (if signing)

## See %{_pkgdocdir}/INSTALL for detailed instructions.

## CONFIGURATION OPTIONS

# Specifies the path to the process ID file.
PidFile /var/run/opendkim/opendkim.pid

# Selects operating modes. Valid modes are s (sign) and v (verify). Default is v.
# Must be changed to s (sign only) or sv (sign and verify) in order to sign outgoing
# messages.
Mode    sv

# Log activity to the system log.
Syslog  yes

# Log additional entries indicating successful signing or verification of messages.
SyslogSuccess   yes

# If logging is enabled, include detailed logging about why or why not a message was
# signed or verified. This causes an increase in the amount of log data generated
# for each message, so set this to No (or comment it out) if it gets too noisy.
LogWhy  yes

# Attempt to become the specified user before starting operations.
UserID  opendkim:opendkim

# Create a socket through which your MTA can communicate.
Socket  inet:8891@localhost

# Required to use local socket with MTAs that access the socket as a non-
# privileged user (e.g. Postfix)
Umask   002

# This specifies a text file in which to store DKIM transaction statistics.
# OpenDKIM must be manually compiled with --enable-stats to enable this feature.
#Statistics     /var/spool/opendkim/stats.dat

## SIGNING OPTIONS

# Selects the canonicalization method(s) to be used when signing messages.
Canonicalization        relaxed/relaxed

# Domain(s) whose mail should be signed by this filter. Mail from other domains will
# be verified rather than being signed. Uncomment and use your domain name.
# This parameter is not required if a SigningTable is in use.
Domain  sample.com

# Defines the name of the selector to be used when signing messages.
Selector        default

# Specifies the minimum number of key bits for acceptable keys and signatures.
MinimumKeyBits 1024

# Gives the location of a private key to be used for signing ALL messages. This
# directive is ignored if KeyTable is enabled.
#KeyFile        /etc/opendkim/keys/default.private

# Gives the location of a file mapping key names to signing keys. In simple terms,
# this tells OpenDKIM where to find your keys. If present, overrides any KeyFile
# directive in the configuration file. Requires SigningTable be enabled.
#KeyTable       /etc/opendkim/KeyTable
KeyTable refile:/etc/opendkim/KeyTable

# Defines a table used to select one or more signatures to apply to a message based
# on the address found in the From: header field. In simple terms, this tells
# OpenDKIM how to use your keys. Requires KeyTable be enabled.
#SigningTable   refile:/etc/opendkim/SigningTable
SigningTable refile:/etc/opendkim/SigningTable

# Identifies a set of "external" hosts that may send mail through the server as one
# of the signing domains without credentials as such.
#ExternalIgnoreList     refile:/etc/opendkim/TrustedHosts
ExternalIgnoreList refile:/etc/opendkim/TrustedHosts

# Identifies a set "internal" hosts whose mail should be signed rather than verified.
#InternalHosts  refile:/etc/opendkim/TrustedHosts
InternalHosts refile:/etc/opendkim/TrustedHosts

vi /etc/opendkim/KeyTable

dkimselector._domainkey.sample.com sample.com:dkimselector:/etc/opendkim/keys/sample.com/dkimselector.private

vi /etc/opendkim/SigningTable

*@sample.com dkimselector._domainkey.sample.com

cat /etc/opendkim/keys/sample.com/dkimselector.txt

dkimselector._domainkey IN      TXT     ( "v=DKIM1; k=rsa; "
      "p=MIGfMA0GCS..." )  ; ----- DKIM key dkimselector for sample.com

# readme_directory: The location of the Postfix README files.
#
readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES


message_size_limit = 0

smtpd_milters = inet:127.0.0.1:8891
non_smtpd_milters = $smtpd_milters
milter_default_action = accept

service opendkim start

Generating default DKIM keys: [ OK ]
Starting OpenDKIM Milter: [ OK ]

service postfix reload

chkconfig opendkim on

echo "Test Mail." | mail -s "test mail" -r webmaster@sample.com sa-test@sendmail.net

# be verified rather than being signed. Uncomment and use your domain name.
# This parameter is not required if a SigningTable is in use.
Domain sample.com, hogehoge.jp
　
# Defines the name of the selector to be used when signing messages.

cd /etc/opendkim/keys/
mkdir hogehoge.jp
cd hogehoge.jp
opendkim-genkey -d hogehoge.jp -s dkimselector
chown -R opendkim:opendkim /etc/opendkim/keys

dkimselector._domainkey.hogehoge.jp hogehoge.jp:dkimselector:/etc/opendkim/keys/hogehoge.jp/dkimselector.private

*@hogehoge.jp dkimselector._domainkey.hogehoge.jp

cat /etc/opendkim/keys/hogehoge.jp/dkimselector.txt

service opendkim restart
service postfix reload

echo "Test Mail." | mail -s "test mail" -r test@hogehoge.jp sa-test@sendmail.net

nslookup -q=txt dkimselector._domainkey.sample.com

dig -t TXT dkimselector._domainkey.sample.com @8.8.8.8