DKIMproxy - Frequently Asked Questions

Back to DKIMproxy support page.

Here are some frequently asked questions, with answers.

Why are my messages not getting signed?
How do I sign email submitted locally using sendmail?
Outgoing mail is getting an Authentication-Results header instead of the expected DomainKey-Signature. Verifiers report "no signature". What's going on?
My server is only used for sending email. Can I make it sign messages on port 25 instead of port 587 as used in the example?
Outgoing messages get stuck in the queue before getting signed. The Postfix log files report TLS handshake error. What causes this?
I get "socket connect failure: Connection refused" or "socket connect failure: Invalid argument". What causes this?

Why are my messages not getting signed?

The most common reason for messages not getting signed is that your outbound mail is not going through DKIMproxy. If you use the setup recommended on this site, you will need to configure your mail client (e.g. Thunderbird, etc.) to use port 587 to submit mail. This is a change from the usual default of port 25.

See the next question if your mail client uses the sendmail command-line interface (rather than SMTP) to submit mail.

If your mail is going through DKIMproxy, then check your mail log file for an explanation. DKIMproxy will write to the log file for every message it relays.

How do I sign email submitted locally using `sendmail`?

Email submitted using Postfix sendmail on the same server as dkimproxy will not get signed unless you add the content_filter option to the pickup interface in master.cf.

master.cf:

pickup    fifo  n       -       n       60      1       pickup
    -o content_filter=dksign:[127.0.0.1]:10027

Outgoing mail is getting an Authentication-Results header instead of the expected DomainKey-Signature. Verifiers report "no signature". What's going on?

Your outgoing mail is going through the DKIMproxy verifier (dkimproxy.in) instead of the DKIMproxy signer (dkimproxy.out). Messages are verified or signed depending on which Postfix port you submit the mail on. If you followed my instructions, Postfix port 25 mail gets verified (this is the port other MTAs use to send mail to you) and Postfix port 587 mail gets signed. Most email clients (e.g. Thunderbird) default to port 25, so you should change that to port 587. (Port 587 is the standard mail submission port according to RFC 2476.)

My server is only used for sending email. Can I make it sign messages on port 25 instead of port 587 as used in the example?

Yes. In your master.cf, look at the example for using the submission port, and add those same parameters to the smtp service. This will configure Postfix to reject incoming mail, so only use this fix if you really only send mail with your server. E.g. you might have...

smtp  inet  n     -       n       -       -       smtpd
    -o smtpd_etrn_restrictions=reject
    -o smtpd_sasl_auth_enable=yes
    -o content_filter=dksign:[127.0.0.1]:10027
    -o receive_override_options=no_address_mappings
    -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
submission  inet  n     -       n       -       -       smtpd
    -o smtpd_etrn_restrictions=reject
    -o smtpd_sasl_auth_enable=yes
    -o content_filter=dksign:[127.0.0.1]:10027
    -o receive_override_options=no_address_mappings
    -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject

Outgoing messages get stuck in the queue before getting signed. The Postfix log files report TLS handshake error. What causes this?

Postfix is trying to use TLS (encryption) when sending email through the content filter. This won't work. You'll need to configure your post-dksign-smtpd server to not announce TLS support, or configure your pre-dksign-smtp client to not use TLS.

This example shows how to configure the post-dksign-smtpd server to not announce TLS support.

master.cf:

#
# service for accepting messages FROM the DomainKeys signing filter
#
127.0.0.1:10028 inet  n  -      n       -       10      smtpd
    -o smtpd_use_tls=no
    -o content_filter=
    -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
    -o smtpd_helo_restrictions=
    -o smtpd_client_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=permit_mynetworks,reject
    -o mynetworks=127.0.0.0/8
    -o smtpd_authorized_xforward_hosts=127.0.0.0/8

I get "socket connect failure: Connection refused" or "socket connect failure: Invalid argument". What causes this?

You are running dkimproxy.in and/or dkimproxy.out, and you connect to the listening port, but the connection is terminated immediately. Furthermore, you get the following output from dkimproxy:

./dkimproxy.in: socket connect failure: Connection refused

(On some platforms, the error is socket connect failure: Invalid argument.)

The filter is unable to connect to its "destination" port. Normally, Postfix should be listening on this port. Make sure you have added the appropriate entries to master.cf for the listening port and have restarted Postfix.

Last updated: 2008-07-17