If your sending domains already sign with DKIM, then this should not be changed.

SpamExperts will simply forward the DKIM signed messages along to the recipient.

If there is no DKIM signing, you can decide to either sign this on your sending MTA or sign with SpamExperts.

It's not obliged to sign with DKIM, however, it often helps to "authenticate" as much as possible your senders.

DKIM Certificate Generation

DKIM is an email authentication method designed to detect forged sender addresses in email. When signing outgoing messages with DKIM, recipients can verify a respective message is from the sender it claims to be from and that the content of the message has not been modified.

Why should I use DKIM?

There are several advantages to using DKIM to sign your outgoing emails:

• The recipient is able to verify that the message originated from the specified sender.
• The recipient is able to verify that the message content (and important headers e.g. the subject) has not been altered.
• It lowers the chance of the email being identified as spam, although this is not the primary reason to sign.

If a spammer is trying to abuse your domain or email address, using DKIM reduces the chances of spam getting through. Many email servers check for a valid DKIM signature on incoming email.

How does it work?

DKIM adds a special DKIM Signature to the email headers. This signature contains a hashed value of the content (both important headers and the body). When a server that is checking for DKIM receives an email, it does the following:

1. Retrieves the public key from the DNS of the sending domain.
2. Uses the key to decrypt the signature.
3. Verifies the content.

The exact actions a mail server takes when it discovers an invalid signature depends on the configuration of that server.

What do you sign by default?

Besides the body, the following headers are by default included in the signing:

• from
• date
• subject
• reply-to
• sender
• to
• cc
• bcc
• message-id
• in-reply-to
• references
• content-type
• mime-version
• content-transfer-encoding

Generate a DKIM certificate in the Spam Experts Control Panel

1. In the Domain Level Control Panel, select Outgoing > DKIM.

2. Choose the DKIM key length (we advise 2048 if your DNS can accept that).

3. Enter the DKIM selector and click on Generate and save new private/public pair.

Once the key has been generated, you will need to add it to the DNS on the subdomain, for example with:

test._domainkey.example.com

Save this in your DNS as a TXT record and then, in the Outgoing User Settings page for your outgoing user ( see Manage Outgoing Users), you need to enter 'test' in the DKIM Selector field.

Any domain that sends using outgoing authentication that has this selector, should sign with this (assuming they do not have their own DKIM).

How can I set DKIM up via the command line?

If you have our Local Cloud product, you can set up DKIM via the command line.

Prerequisites

• Python
• OpenSSL
• Access to your DNS
• Spam Experts Outgoing Filtering enabled on your cluster.

Create keys

DKIM uses a pair of public and private keys - the private key is known only to you (and Spam Experts, since we are signing the mail on your behalf) and is used to create the signature. The public key is available to anyone and can be used to verify that the correct private key was used.

Generate a private key

openssl genrsa -out domainname.com.key 2048

Generate a public key

openssl rsa -in domainname.com.key -out rsa.public -pubout -outform PEM

Create a DNS record

In order for the receiving mail server to obtain your public key, you must create a DNS record for the specified domain.

selector._dkim TXT "k=rsa; p=[public key in one line];"

The name "selector" can be anything and you can use it to have different keys with the same domain. Make sure you use the same name in the next steps.

Configure the keys

In order to use the keys for all outgoing mails for a certain user, there are a few steps to take to implement this in your Spam Experts Filtering Cluster.

Create a file "makepriv.py" and enter the following content:

s = """
-----BEGIN RSA PRIVATE KEY-----
YOUR KEY HERE
-----END RSA PRIVATE KEY-----
"""
import urllib
print urllib.quote(s)

Replace the YOUR KEY HERE part with the contents of your private key. Execute this:

python makepriv.py

It will return your key in a single line.

Input the name of the selector into the API. To do so, you should replace a few values in the URL:

https://SERVERNAME/cgi-bin/api?call=api_set_dkim_certificate&domain=DOMAINNAME&certificate=VALUE&selector=SELECTOR

1. Replace SERVERNAME with the hostname of your primary server or the used CNAME
2. Replace DOMAIN NAME with the domain name you want to be using DKIM
3. Replace VALUE with the value the Python script earlier produced.
4. Replace SELECTOR with the desired selector you've chosen earlier.

To finish things up, the desired outgoing user should be DKIM enabled:

https://SERVERNAME/cgi-bin/api?call=api_set_dkim_selector&domain=DOMAINNAME&selector=SELECTOR&username=USERNAME

1. Replace SERVERNAME with the hostname of your primary server or the used CNAME
2. Replace DOMAIN NAME with the domain name you want to be using DKIM
3. Replace SELECTOR with the desired selector you've chosen earlier.
4. Replace USERNAME with the username of the outgoing user.

Your outgoing emails that are being sent through the Outgoing Filter will now be signed with your DKIM key.