DKIM-ondertekening in KumoMTA

Definieer een signer in init.lua:

local signer = kumo.dkim.rsa_sha256_signer {
  domain   = 'example.com',
  selector = 's2026',
  headers  = { 'From', 'To', 'Subject', 'Date', 'Message-ID', 'List-Unsubscribe' },
  key      = '/etc/kumomta/dkim/example.com/s2026.key',
}

kumo.on('smtp_server_message_received', function(msg)
  msg:dkim_sign(signer)
end)

Publiceer de publieke sleutel op s2026._domainkey.example.com IN TXT:

v=DKIM1; k=rsa; p=MIIBIjANBg...

Ondertekenen voor meerdere tenants:

kumo.on('smtp_server_message_received', function(msg)
  local domain = msg:from_header_address():match('@(.+)$'):lower()
  local signer_for_domain = signers_by_domain[domain]
  if signer_for_domain then msg:dkim_sign(signer_for_domain) end
end)

Altijd 2048-bit RSA. Wissel jaarlijks van selector. Onderteken altijd List-Unsubscribe, want zo valideert de one-click unsubscribe van Gmail.