OpenDKIM and Postfix: Signing DKIM for multiple domains

How do I use OpenDKIM with multiple domain names on a single postfix server? That's a question I myself had when I first set up my current VPS to host my current email system. So I searched around a bit. I found this guide, but it's kind of a pain in the rear. Too much heavy lifting.

So I tried this instead. It's a bit of a hacker trick nobody seems to mention online: In your opendkim.conf file, where you specify the domain, you can just include multiple domains here, separated by commas.

Instead of
domain example.com
Just put
domain example.com,example.org,mydomain3.com
In your opendkim.conf file.

Upside: Super easy.
Downside: All domains have to share the same DKIM key, because there's only one DKIM key setting in opendkim.conf.

It works fine. Though you specify the domain name when creating a DKIM key, there's nothing in the key that is actually domain-specific. At scale, this is insecure. At the hobbyist level, where I've got three domains running on my one server that send a grand total of 150 emails a day, I don't find it to be that much of a concern.

You can also put an asterisk (*) to wildcard the domain setting in opendkim.conf. However, I don't recommend this, because it will try to sign all mail for any domain, without checking to see if a DKIM public key actually exists for that domain. So if you send or forward any mail at all for any other domain, that mail will end up with a broken DKIM signature attached to it. An example where this will happen and be very bad for you is mailing lists. Some mailing lists rewrite the from address to use their own domain to bypass DMARC concerns, but not all do, and some only do it sometimes. So I strongly recommend against using a wildcard here, unless you know what you're doing.

No comments:

Post a Comment

Comments policy: Al is always right. Kidding, mostly. Be polite, and you're welcome to join in, even if it's a differing viewpoint.