いよいよ署名を付けてみます。
他の設定は済んでいるので、postfixのmaster.cfに記述するだけです。
参考サイト： http://dkimproxy.sourceforge.net/postfix-outbound-howto.html
sasl-authで587番ポートを使用しているのでこのポートに来たメールのみ署名をします。
# # modify the default submission service to specify a content filter # and restrict it to local clients and SASL authenticated clients only # submission inet n - n - - smtpd -o smtpd_etrn_restrictions=reject -o smtpd_sasl_auth_enable=yes -o content_filter=dksign:[127.0.0.1]:10027 -o receive_override_options=no_address_mappings -o smtpd_client_restrictions=permit_sasl_authenticated,reject マイネットワーク以外からの送信が出来ないのでこの行を追加しました。 -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject # # specify the location of the DKIM signing proxy # Note: we allow "4" simultaneous deliveries here; high-volume sites may # want a number higher than 4. # Note: the smtp_discard_ehlo_keywords option requires Postfix 2.2 or # better. Leave it off if your version does not support it. # dksign unix - - n - 4 smtp -o smtp_send_xforward_command=yes -o smtp_discard_ehlo_keywords=8bitmime,starttls # # service for accepting messages FROM the DKIM signing proxy # 127.0.0.1:10028 inet n - n - 10 smtpd -o content_filter= -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks -o smtpd_helo_restrictions= -o smtpd_client_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions=permit_mynetworks,reject -o mynetworks=127.0.0.0/8 -o smtpd_authorized_xforward_hosts=127.0.0.0/8
さていよいよ送信テストです。sa-test@sendmail.net へメールを送信します。
程なく返信メールが来ました、さて結果は、
sendmail.net Sender Authentication Auto-Responder $Revision: 1.19 $ This service runs at <sa-test@sendmail.net> and allows remote users to perform a simple, automated test to see if different Sender Authentication schemes are working. Mail sent to this service is checked by our Sender Authentication filters for any valid credentials or signatures. A script receives the message, checks for a special header with the results of the tests, and composes this response message based on what it finds. This response is also signed with DomainKeys Identified Mail (DKIM). Please note that the DKIM filter signing this reply message conforms to the latest IETF standard version, and thus may not be successfully verified by older implementations. If you are using dkim-filter from Sendmail, Inc., upgrade to OpenDKIM to be compatible with the most recent version of DKIM. Note that DomainKeys has been removed in favor of DKIM. Sites still using DomainKeys should upgrade to DKIM ASAP. We hope this service has been helpful to you. Authentication System: DomainKeys Identified Mail (DKIM) Result: DKIM signature confirmed GOOD Description: Signature verified, message arrived intact Reporting host: services.sendmail.com More information: http://dkim.org/ Sendmail milter: http://opendkim.org/ Authentication System: Sender ID Result: SID data confirmed GOOD Description: Sending host is authorized for sending domain Reporting host: services.sendmail.com More information: http://www.microsoft.com/senderid Sendmail milter: https://sourceforge.net/projects/sid-milter/ Authentication System: Sender Permitted From (SPF) Result: SPF data confirmed GOOD Description: Sending host is authorized for sending domain Reporting host: services.sendmail.com More information: http://openspf.org/
あれっ!
DKIM signature confirmed GOOD
ということは、DNSのドメインキーレコードは正常ということになりますね？？？
ためしにこちらのサイトで再検証してみました。
http://dkimcore.org/tools/dkimrecordcheck.html
結果は This is a valid DKIM key record
DNSの設定はこのままで良さそうです？？？あの一日はなんだったんだろう