Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Postfix does not create DKIM signatures on its own. On a Linux VPS, the usual design is to run OpenDKIM as a signing milter, let Postfix pass outgoing messages to it, and publish OpenDKIM’s public key in DNS. DKIM works only when the domain, selector, private-key path, OpenDKIM socket, and DNS record all match exactly.
This guide covers Debian-family systems and outbound signing. It shows a single-domain setup first, then explains multi-domain tables, socket choices, key rotation, verification, and the failure modes that account for most configuration problems.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems
How Postfix, OpenDKIM, and DNS fit together
DKIM (DomainKeys Identified Mail) is a sender-authentication system. OpenDKIM creates a cryptographic signature and adds a DKIM-Signature header to a message. Postfix acts as the mail transport agent and hands the message to OpenDKIM through the Milter protocol before queueing or delivering it.
The recipient uses the selector and signing domain in that header to find a DNS TXT record at selector._domainkey.domain. It retrieves the public key, checks the signature against the message headers and body, and reports the result in an Authentication-Results header. The private key never belongs in DNS and must remain readable only by the OpenDKIM service.
The five values that must agree
- Signing domain: the domain OpenDKIM places in the signature, such as
yourdomain.example. - Selector: a label such as
mailthat identifies one key, not the whole domain. - Private-key path: the local file OpenDKIM reads.
- Milter socket: the TCP or UNIX socket through which Postfix contacts OpenDKIM.
- DNS owner name and public key: the selector-based TXT record containing the matching public key.
A mismatch in any one of these values can produce no signature, a key lookup failure, or a signature that recipients cannot validate.
Prerequisites and scope
Have the following ready before changing configuration:
- A domain whose DNS zone you can edit.
- A functioning Postfix installation on a Linux VPS.
- A stable server hostname and working outbound SMTP configuration.
- Root or
sudoaccess. - A mailbox you control for receiving a test message and inspecting its complete headers.
The commands below use Debian-family package names and paths. Ubuntu and Debian releases can differ in service defaults, AppArmor or systemd restrictions, and whether Postfix runs in a chroot. Check the configuration files installed by your distribution rather than assuming that every path is identical. This article configures outbound signing; receiving mail, DMARC policy, SPF, and provider-specific DNS screens are separate tasks.
Install OpenDKIM and its utilities
Install the signer and the command-line tools used to test keys:
sudo apt update
sudo apt install opendkim opendkim-toolsThe package supplies the OpenDKIM daemon, key-generation utility, and opendkim-testkey. During installation, note the service account name used by your package, normally opendkim. That account must be able to read the private key but should not have general access to it.
Choose a selector and generate the key pair
A selector lets you publish more than one key for a domain and rotate keys without an outage. Use a descriptive label such as mail, or include a rotation period such as 2026-10. The selector is case-sensitive in configuration even though DNS names are generally compared case-insensitively, so use the same spelling everywhere.
Recommended Free Tools
Create a directory for the keys and generate a pair. The Debian example uses a 2048-bit RSA key by default:
sudo mkdir -p /etc/dkimkeys
sudo -u opendkim opendkim-genkey -D /etc/dkimkeys -d yourdomain.example -s mailThis creates a private key such as /etc/dkimkeys/mail.private and a DNS-ready file such as /etc/dkimkeys/mail.txt. The -d value is the signing domain and -s is the selector; both must match the later OpenDKIM and Postfix setup.
Protect the private key
Give ownership to the service account. The Debian Handbook demonstrates:
sudo chown opendkim.opendkim /etc/dkimkeys/mail.*Keep restrictive permissions so ordinary users cannot read the private key. A typical installation uses owner read access and no access for group or other users, but preserve the mode expected by your distribution’s package. OpenDKIM’s RequireSafeKeys behavior can reject keys with unsafe ownership or permissions. Also verify permissions on every parent directory: the daemon needs execute (directory traversal) permission without granting other users access to the key itself.
Publish the public key in DNS
Open the generated mail.txt file and copy its complete TXT value. Create a TXT record with this owner name:
mail._domainkey.yourdomain.exampleThe value begins with v=DKIM1; and includes the public-key tag p=. Do not publish the contents of mail.private. A Debian example uses a TTL of 3600 seconds and an RSA/SHA-256 key; that TTL is an example, not a universal requirement.
Long TXT values
DNS providers may display one long value as several quoted strings. That is normal: the DNS response concatenates the strings. Preserve every character of the generated public key, including the entire p= value, and do not add line breaks or explanatory text inside the record.
Some DNS systems impose a 255-character limit on an individual text string. Use the provider’s supported string-splitting interface so the complete value is returned as one TXT record. If the provider cannot represent the generated value, the Debian documentation describes using a smaller key with -b 1024, but that reduces cryptographic strength and should be considered only when the DNS limitation leaves no better option.
Check the record before configuring the daemon
Query the exact owner name with a DNS utility or your provider’s diagnostic tool. Confirm that the answer contains v=DKIM1 and an uninterrupted public-key value. DNS propagation can delay a result according to the record’s TTL, so a newly created record may not be visible from every resolver immediately.
Configure OpenDKIM for one domain and one key
For a single domain and selector, the essential settings are:
Domain yourdomain.example
Selector mail
KeyFile /etc/dkimkeys/mail.private
Socket inet:8891@localhostPlace these directives in the OpenDKIM configuration file used by your package. Some distributions split settings between a main file and included files; edit the file that the running service actually loads. The TCP socket above listens on localhost port 8891. A local UNIX socket is also valid, but Postfix must be able to reach it from its execution context, including any chroot.
Restart OpenDKIM after changing its configuration:
sudo systemctl restart opendkimCheck the service status and system journal before involving Postfix. A daemon that starts but cannot read the key will not sign messages, and a daemon listening on a different socket cannot receive Postfix’s requests.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Use KeyTable and SigningTable for multiple domains or selectors
The single-key settings are easy to understand but do not scale when several domains or rotation keys are involved. OpenDKIM’s table mode separates key definitions from sender-to-key selection.
KeyTable
KeyTable maps a key name to a domain, selector, and private-key path. Conceptually, an entry has this form:
mailkey yourdomain.example:mail:/etc/dkimkeys/mail.privateWhen KeyTable is defined, it overrides KeyFile, and the standalone Selector setting is ignored. Leaving an old KeyFile or Selector in the file does not change the table mapping, which is a common source of confusion.
SigningTable
SigningTable chooses a key-table entry from the sender identity. A simple exact-address mapping might look like:
Free tools Windows power users keep installed
One-click scans. No signup required.
user@yourdomain.example mailkeyA wildcard or pattern can cover a domain, depending on the syntax and matching mode enabled by your OpenDKIM version. Use separate entries when different domains or selectors need different private keys. Ensure that the address pattern matches the identity OpenDKIM evaluates; a table that does not match produces an unsigned message even when the daemon and key are healthy.
When table mode is worthwhile
- Use the single-key model for one domain and one active selector.
- Use
KeyTableandSigningTablewhen several domains, sender identities, or rotation generations must coexist. - Keep one private-key file per selector and record the mapping in configuration management so a rotation cannot silently point to the wrong file.
Attach OpenDKIM to Postfix
Edit /etc/postfix/main.cf and add the milter settings:
smtpd_milters = inet:localhost:8891
non_smtpd_milters = $smtpd_milters
milter_default_action = acceptsmtpd_milters applies to mail injected through an SMTP session. non_smtpd_milters applies to locally generated or locally submitted mail, such as notifications created by applications on the VPS. Setting only the first parameter explains why externally submitted test messages may be signed while system-generated messages are not.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutemilter_default_action = accept tells Postfix to accept mail when the milter is temporarily unavailable instead of rejecting or losing the message. This favors delivery continuity, but it also means a socket outage can create unsigned mail. Monitor the OpenDKIM service and inspect headers so an outage is visible rather than silently accepted.
If you choose a UNIX socket, replace the TCP address in both OpenDKIM and Postfix with the exact socket path and verify permissions. A socket under a directory inaccessible to Postfix, or outside the path visible inside a Postfix chroot, produces a connection error even when OpenDKIM is running.
Reload Postfix after saving the file:
sudo systemctl reload postfixUse restart only when your distribution or a broader configuration change requires it; a reload normally applies main.cf changes without interrupting queued mail.
Validate the key and send a controlled test
Run opendkim-testkey
Test the same domain and selector used in the daemon:
sudo opendkim-testkey -d yourdomain.example -s mail -vvvA successful result indicates that OpenDKIM can reconcile the local key configuration with the DNS TXT record according to the Debian tooling. Run the command from a host that uses a resolver able to see the authoritative record. Diagnostic output such as key not secure, a lookup failure, or a missing key points to DNS publication, record spelling, or resolver visibility rather than to Postfix.
Inspect a delivered message
Send a message to a mailbox you control. View the original, unmodified headers rather than a simplified webmail summary. A correctly signed message normally contains:
- A
DKIM-Signatureheader showing the signing domain ind=, the selector ins=, and a body/header hash. - An
Authentication-Resultsheader reportingdkim=passfor the expected domain and selector.
If the message has no DKIM-Signature, troubleshoot the Postfix-to-milter path, the sender identity selected by OpenDKIM, and the non_smtpd_milters setting. If a signature exists but authentication fails, compare the recipient’s selector lookup with the exact d= and s= values in the header, then check whether the message changed after signing.
Compare the main configuration choices
| Choice | Option A | Option B | Operational effect |
|---|---|---|---|
| Key mapping | Single KeyFile and Selector |
KeyTable plus SigningTable |
Single mode is simpler; table mode supports multiple domains, identities, and selectors. In table mode, KeyTable overrides KeyFile and Selector is ignored. |
| Postfix connection | TCP localhost socket, such as inet:8891@localhost |
UNIX socket | TCP is straightforward to inspect and commonly documented; UNIX sockets avoid a TCP listener but require correct filesystem permissions and chroot visibility. |
| Canonicalization | simple |
relaxed |
simple is less tolerant of whitespace and formatting changes. relaxed tolerates more ordinary header and body formatting changes, but neither protects against arbitrary content edits. |
| Domain scope | One domain and selector | Several domains or selectors | One domain is easiest to audit. Multiple identities require explicit table mappings and a documented rotation plan. |
Canonicalization is a compatibility choice, not a cure for intermediary rewriting. Mailing-list software and other intermediaries can alter signed headers or body content enough to invalidate either mode. Choose settings supported by your OpenDKIM policy and test with the mail paths your users actually use.
Troubleshoot the failures you are most likely to see
key not secure or a DNS lookup failure
- Query
selector._domainkey.yourdomain.example, not the bare domain. - Confirm the selector in the query exactly matches the
s=value and OpenDKIM configuration. - Re-copy the complete
p=value from the generated file. - Check that your resolver can see the authoritative record and that a stale negative answer has expired.
No signature on locally generated mail
Check non_smtpd_milters. Postfix handles mail created locally through a separate path from SMTP-injected mail. Keep the value set to the same socket as smtpd_milters, or configure both explicitly.
OpenDKIM cannot read the private key
- Verify the path, owner, and mode of the key and every parent directory.
- Confirm the service really runs as the account that owns the key.
- Review systemd, AppArmor, SELinux, or other confinement logs if the permissions appear correct.
- In strict configurations, correct unsafe permissions rejected by
RequireSafeKeys.
Postfix cannot connect to OpenDKIM
Compare the protocol and address on both sides: inet:8891@localhost is not interchangeable with a UNIX path. Confirm that OpenDKIM is listening, that localhost resolves as expected, and that a Postfix chroot does not hide the socket. Service logs usually distinguish a refused TCP connection from a missing UNIX socket.
The signature passes initially but fails downstream
Mailing lists, forwarding services, and other intermediaries may rewrite signed headers or body content. A valid signature at the first recipient can therefore fail after redistribution. Inspect the first delivered copy and the final copy, and identify which intermediary changed the message before altering canonicalization or signing policy.
The DNS TXT value appears truncated
Check the authoritative response rather than only the provider’s editor. If the provider has split the value into multiple strings, verify that all strings are present and returned together. If the provider cannot store the generated key within its text limits, consider a supported split format or, only after assessing the security trade-off, regenerate with -b 1024.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rotate keys without breaking delivery
Do not overwrite an active private key while messages signed with it may still be in transit. Generate a new selector and key pair, publish the new TXT record, and wait until the record is visible through the resolvers used by recipients. Then change OpenDKIM’s selector or table mapping and reload the service. Keep the old DNS record during a transition period so recipients can validate messages already signed with the previous selector. Remove the old record only after the maximum expected delivery and retry window has passed.
After each rotation, run opendkim-testkey with the new selector and inspect a real delivered message. Record the selector, key path, publication time, and removal date so future operators can distinguish an intentional overlap from a stale record.
Production checklist
- Confirm DNS control, a working Postfix installation, a stable hostname, and outbound SMTP.
- Install
opendkimandopendkim-tools. - Generate a key pair with a unique selector and the intended domain.
- Protect the private key with OpenDKIM ownership and restrictive permissions.
- Publish the generated public key at
selector._domainkey.domainand preserve the complete TXT value. - Configure
Domain,Selector,KeyFile, and a reachableSocket, or build equivalentKeyTableandSigningTableentries. - Set both
smtpd_miltersandnon_smtpd_miltersin Postfix. - Set an intentional
milter_default_action;acceptprevents a temporary signer outage from rejecting mail but requires monitoring. - Restart OpenDKIM and reload Postfix.
- Run
opendkim-testkey -d yourdomain.example -s mail -vvv. - Send a test message and verify
DKIM-SignatureplusAuthentication-Results: ... dkim=pass. - Document selectors and rotate keys with an overlap period.
What a correct result looks like
For the single-key example, OpenDKIM reads /etc/dkimkeys/mail.private, listens on localhost port 8891, and signs mail for yourdomain.example with selector mail. Postfix sends both SMTP-submitted and locally generated messages through that milter. A recipient looks up mail._domainkey.yourdomain.example, obtains the matching public key, and reports a passing DKIM result. If any link in that chain differs, fix the mismatch at its source rather than adding unrelated DNS records or repeatedly restarting services.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →
