Define a signer in init.lua:
local signer = kumo.dkim.rsa_sha256_signer {
domain = 'example.com',
selector = 's2026',
headers = { 'From', 'To', 'Subject', 'Date', 'Message-ID', 'List-Unsubscribe' },
key = '/etc/kumomta/dkim/example.com/s2026.key',
}
kumo.on('smtp_server_message_received', function(msg)
msg:dkim_sign(signer)
end)
Publish public key at s2026._domainkey.example.com IN TXT:
v=DKIM1; k=rsa; p=MIIBIjANBg...
Multi-tenant signing:
kumo.on('smtp_server_message_received', function(msg)
local domain = msg:from_header_address():match('@(.+)$'):lower()
local signer_for_domain = signers_by_domain[domain]
if signer_for_domain then msg:dkim_sign(signer_for_domain) end
end)
Always 2048-bit RSA. Rotate selectors yearly. Always sign List-Unsubscribe — it's how Gmail's one-click unsub validates.
Sign in to keep track of what you have read.