DKIM on aliased domains with rspamd and postfix

Question

I'm having trouble DKIM signing my outgoing emails when they're sent from an alias domain. That is, when I'm authenticated with user@domain1.com sending as user@domain1.com or somebodyelse@domain1.com my emails are correctly DKIM-signed, but if I send as doejohn@domain2.com the signature is NOT added to the mail header. I'm using postfix and rspamd, here are the relevant files:

Postfix

main.cf

(initial boilerplate omitted for brevity)

virtual_mailbox_domains = pgsql:/etc/postfix/pgsql-virtual-mailbox-domains.cf
virtual_mailbox_maps = pgsql:/etc/postfix/pgsql-virtual-mailbox-users.cf
virtual_alias_maps = pgsql:/etc/postfix/pgsql-virtual-alias-maps.cf
virtual_transport = lmtp:unix:private/dovecot-lmtp
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_tls_security_level = may
smtpd_tls_auth_only = yes
smtp_tls_security_level = may
smtpd_sender_login_maps = pgsql:/etc/postfix/pgsql-virtual-alias-maps.cf
smtpd_milters = inet:127.0.0.1:11332
non_smtpd_milters = inet:127.0.0.1:11332
milter_protocol = 6
milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}

master.cf

(default configs omitted for brevity)

submission inet n - - - - smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
  -o smtpd_sasl_security_options=noanonymous
  -o smtpd_sender_login_maps=pgsql:/etc/postfix/pgsql-email2email.cf
  -o smtpd_sender_restrictions=reject_unauthenticated_sender_login_mismatch
  -o smtpd_sasl_local_domain=$myhostname
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o smtpd_recipient_restrictions=reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject

rspamd

local.d/dkim_signing.conf

path = "/var/lib/rspamd/dkim/$domain.$selector.key";
selector_map = "/etc/rspamd/dkim_selectors.map";

Permissions at dkim selectors path are r-x------ for files and r-xr-x--- for folder.

score 1 · Accepted Answer · answered Apr 22 '19 at 06:06

From DKIM signing module's Principles of operation:

The DKIM signing module chooses signing domains and selectors according to a predefined policy which can be modified with various settings. Description of this default policy follows: - -

If authenticated user is present, this should be suffixed with @domain where domain is what’s seen is envelope/header From address

The secondary domain doesn't match the domain of the authenticated user. To alter this default behaviour, your dkim_signing.conf should have:

allow_username_mismatch = true;

.

DKIM on aliased domains with rspamd and postfix

1 Answers1