Rspamd signs every outbound message that matches a configured DKIM key for the From domain.
Setup flow:
- UI → Email → Configuration → ARC/DKIM keys → Add (domain, selector, 2048-bit).
- Mailcow shows the DNS TXT to publish. Paste into your DNS host.
- Wait for propagation (1–10 min for most providers).
- Send a test to
check-auth@verifier.port25.comand confirmdkim=pass.
Common gotchas:
- Selector mismatch: the selector in DNS (
s2025._domainkey) must match the one in Mailcow exactly. - Multiple keys: Rspamd will sign with all matching keys. Rotate by adding new selector first, waiting 48 h, then removing old.
- Long DNS records: 2048-bit keys exceed 255 chars and must be split into multiple strings — most DNS hosts handle this automatically.
ARC sealing: enable dkim_signing.conf with sign_authenticated = true; arc = true; so forwarded mail keeps its original auth chain.
Sign in to keep track of what you have read.