1

I've been trying for a long time to start signing mail sent via postfix with opendkim. Looking at the logs, it looks like zero attempt is made to communicate with postfix:

Aug  4 20:59:59 localhost postfix/pickup[49716]: 6430A13EA1C: uid=0 from=<david@davidreghay.com>
Aug  4 20:59:59 localhost postfix/cleanup[49734]: 6430A13EA1C: message-id=<20170804205959.6430A13EA1C@default.example.com>
Aug  4 20:59:59 localhost postfix/qmgr[49717]: 6430A13EA1C: from=<somone@example.com>, size=281, nrcpt=1 (queue active)
Aug  4 21:00:00 localhost postfix/smtp[49736]: 6430A13EA1C: to=<some.guy@gmail.com>, relay=gmail-smtp-in.l.google.com[64.233.183.27]:25, delay=0.7, delays=0.02/0.01/0.19/0.47, dsn=2.0.0, status=sent (250 2.0.0 OK 1501880402 r185si2544740ior.107 - gsmtp)
Aug  4 21:00:00 localhost postfix/qmgr[49717]: 6430A13EA1C: removed

This is in my main.cf for postfix:

milter_protocol = 6
milter_default_action = accept
smtpd_milters = unix:/opendkim/opendkim.sock
internal_mail_filter_classes = bounce

non_smptd_milters = unix:/opendkim/opendkim.sock

I saw on a similar question that this was being caused by no_filter being set on the master.cf for postfix, but this isn't the case for me. Here's my master.cf:

#
# Postfix master process configuration file.  For details on the format
# of the file, see the master(5) manual page (command: "man 5 master").
#
# Do not forget to execute "postfix reload" after editing this file.
#
# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
smtp      inet  n       -       n       -       -       smtpd
#smtp      inet  n       -       n       -       1       postscreen
#smtpd     pass  -       -       n       -       -       smtpd
#dnsblog   unix  -       -       n       -       0       dnsblog
#tlsproxy  unix  -       -       n       -       0       tlsproxy
#submission inet n       -       n       -       -       smtpd
#  -o syslog_name=postfix/submission
#  -o smtpd_tls_security_level=encrypt
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_reject_unlisted_recipient=no
#  -o smtpd_client_restrictions=$mua_client_restrictions
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
#  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
#smtps     inet  n       -       n       -       -       smtpd
#  -o syslog_name=postfix/smtps
#  -o smtpd_tls_wrappermode=yes
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_reject_unlisted_recipient=no
#  -o smtpd_client_restrictions=$mua_client_restrictions
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
#  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
#628       inet  n       -       n       -       -       qmqpd
pickup    unix  n       -       n       60      1       pickup
cleanup   unix  n       -       n       -       0       cleanup
qmgr      unix  n       -       n       300     1       qmgr
#qmgr     unix  n       -       n       300     1       oqmgr
tlsmgr    unix  -       -       n       1000?   1       tlsmgr
rewrite   unix  -       -       n       -       -       trivial-rewrite
bounce    unix  -       -       n       -       0       bounce
defer     unix  -       -       n       -       0       bounce
trace     unix  -       -       n       -       0       bounce
verify    unix  -       -       n       -       1       verify
flush     unix  n       -       n       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       n       -       -       smtp
   -o smtp_send_xforward_command=yes
   -o disable_mime_output_conversion=yes
relay     unix  -       -       n       -       -       smtp
#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq     unix  n       -       n       -       -       showq
error     unix  -       -       n       -       -       error
retry     unix  -       -       n       -       -       error
discard   unix  -       -       n       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       n       -       -       lmtp
anvil     unix  -       -       n       -       1       anvil
scache    unix  -       -       n       -       1       scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent.  See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
#maildrop  unix  -       n       n       -       -       pipe
#  flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
#
# ====================================================================
#
# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
#
# Specify in cyrus.conf:
#   lmtp    cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
#
# Specify in main.cf one or more of the following:
#  mailbox_transport = lmtp:inet:localhost
#  virtual_transport = lmtp:inet:localhost
#
# ====================================================================
#
# Cyrus 2.1.5 (Amos Gouaux)
# Also specify in main.cf: cyrus_destination_recipient_limit=1
#
#cyrus     unix  -       n       n       -       -       pipe
#  user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -r ${sender} -m ${extension} ${user}
#
# ====================================================================
#
# Old example of delivery via Cyrus.
#
#old-cyrus unix  -       n       n       -       -       pipe
#  flags=R user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -m ${extension} ${user}
#
# ====================================================================
#
# See the Postfix UUCP_README file for configuration details.
#
#uucp      unix  -       n       n       -       -       pipe
#  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# ====================================================================
#
# Other external delivery methods.
#
#ifmail    unix  -       n       n       -       -       pipe
#  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
#
#bsmtp     unix  -       n       n       -       -       pipe
#  flags=Fq. user=bsmtp argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient
#
#scalemail-backend unix -       n       n       -       2       pipe
#  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store
#  ${nexthop} ${user} ${extension}
#
#mailman   unix  -       n       n       -       -       pipe
#  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
#  ${nexthop} ${user}

Does anyone see a reason the milter would be completely ignored? I've verified that opendkim is running and listening on the specified socket. Thanks in advance for any and all help on this!

Additionally, I've tried specifying totally bogus values for non_smtpd_milters and no errors or anything show up in the logs when I send test emails using sendmail!? What is happening?

  • 2
    I just checked my mail server, and while DKIM is definitely working (can see it in the headers of mail I send out), nothing is logged by the signing process (either postfix or opendkim itself). So the lack of logging you're seeing isn't necessarily a useful diagnostic. Possible tip: convert to a TCP socket instead of a unix socket, then you can run tcpdump to see (or not see) the comms between postfix + opendkim. Something like "Socket inet:8891@localhost" in opendkim.conf, and "inet:localhost:8891" for the smtpd_milters line – Craig Miskell Aug 05 '17 at 05:01
  • @CraigMiskell thanks for your response. I found the problem and answered below. Appreciate you taking the time to help out! – thisguyheisaguy Aug 06 '17 at 06:48

1 Answers1

1

This is actually really embarrassing... The non_smtpd_milters directive was written with a typo (as you can see in the question above):

non_smptd_milters = unix:/opendkim/opendkim.sock

I wrote non_smptd_milters instead of non_smtpd_milters...

Apologies to anyone whose time I may have wasted on this.