Firma DKIM en KumoMTA

Define un firmante en init.lua:

local signer = kumo.dkim.rsa_sha256_signer {
  domain   = 'example.com',
  selector = 's2026',
  headers  = { 'From', 'To', 'Subject', 'Date', 'Message-ID', 'List-Unsubscribe' },
  key      = '/etc/kumomta/dkim/example.com/s2026.key',
}

kumo.on('smtp_server_message_received', function(msg)
  msg:dkim_sign(signer)
end)

Publica la clave pública en s2026._domainkey.example.com IN TXT:

v=DKIM1; k=rsa; p=MIIBIjANBg...

Firma multi-tenant:

kumo.on('smtp_server_message_received', function(msg)
  local domain = msg:from_header_address():match('@(.+)$'):lower()
  local signer_for_domain = signers_by_domain[domain]
  if signer_for_domain then msg:dkim_sign(signer_for_domain) end
end)

Siempre RSA de 2048 bits. Rota los selectores cada año. Firma siempre List-Unsubscribe, porque así se valida la baja en un clic de Gmail.