2

I have my Debian (7.9 "wheezy") E-Mail-server (Postfix 2.9.6-2) setup to sign and verify DKIM signatures in e-mail messages using OpenDKIM (version 2.6.8-4).

My server passes the DKIM test at GMail when I send a mail from my server to their service but when I send a fresh mail back, my server fails to verify the DKIM signature with the following error in the /var/log/mail.log-logfile:

opendkim[3680]: ABCDEF1234: no signing table match for 'john.doe@googlemail.com'
opendkim[3680]: ABCDEF1234: s=20120113 d=googlemail.com SSL error:04091068:rsa routines:INT_RSA_VERIFY:bad signature
opendkim[3680]: ABCDEF1234: bad signature data

When I try the same with my Yahoo-Mail address it works as expected and my server verifies the Yahoo-message successfully:

opendkim[3680]: ABCDEF1235: no signing table match for 'john.doe@yahoo.com'
opendkim[3680]: ABCDEF1235: DKIM verification successful

Is this an error of the GMail servers or what could I be doing wrong? Could Spamassassin possibly alter the mail before OpenDKIM would process it, in a way that's different from Yahoo's messages, to make the test fail there?

Edit: I had an issue with my DNS on the server but that's now solved. However I am still getting the same result. GMail's messages fail to verify while Yahoo's messages pass without a problem and verify successfully:

opendkim[31437]: ABCDEF123456: nm45-vm6.bullet.mail.ne1.yahoo.com [98.138.121.70] not internal
opendkim[31437]: ABCDEF123456: not authenticated
opendkim[31437]: ABCDEF123456: DKIM verification successful
comfreak
  • 1,451
  • 1
  • 21
  • 32
  • DKIM signature verification is failing very often in practice, unfortunately. The current mail infrastructure seems not to be ready for it :( – sebix Oct 08 '15 at 19:45
  • I also seem to have issues with DNS on my server, maybe that is the problem here too. http://serverfault.com/q/727095/293542 – comfreak Oct 09 '15 at 07:56
  • @sebix Okay, I resolved the DNS issue but it's still the same with the DKIM-verification. GMail fails every time but Yahoo passes the signature check. – comfreak Oct 14 '15 at 17:17

0 Answers0