DKIM-Signatur in KumoMTA

Einen Signer in init.lua definieren:

local signer = kumo.dkim.rsa_sha256_signer {
  domain   = 'example.com',
  selector = 's2026',
  headers  = { 'From', 'To', 'Subject', 'Date', 'Message-ID', 'List-Unsubscribe' },
  key      = '/etc/kumomta/dkim/example.com/s2026.key',
}

kumo.on('smtp_server_message_received', function(msg)
  msg:dkim_sign(signer)
end)

Öffentlichen Schlüssel veröffentlichen unter s2026._domainkey.example.com IN TXT:

v=DKIM1; k=rsa; p=MIIBIjANBg...

Signatur für mehrere Tenants:

kumo.on('smtp_server_message_received', function(msg)
  local domain = msg:from_header_address():match('@(.+)$'):lower()
  local signer_for_domain = signers_by_domain[domain]
  if signer_for_domain then msg:dkim_sign(signer_for_domain) end
end)

Immer 2048-Bit-RSA. Wechseln Sie die Selektoren jährlich. Signieren Sie immer List-Unsubscribe, denn darüber prüft Gmail das One-Click-Unsubscribe.