Postfix で dkim-milter(dkim-filter) を使ってDKIM に対応する(CentOS/ScientificLinux編)

$ yum install dkim-milter --enablerepo=epel
...
Is this ok [y/N]: y
...

# 署名用のディレクトリを作成します。
$ mkdir /etc/dkim
$ cd /etc/dkim

# dkim-milter同梱のdkim-genkeyを使って、署名に必要な公開キーと秘密キーを作成します。
[/etc/dkim]$ dkim-genkey -s example_com_selector -d exmaple.com

# 作成された公開キーと秘密キーファイルを確認します。
[/etc/dkim]$ ls
example_com_selector.private  example_com_selector.txt

example_com_selector._domainkey IN TXT "v=DKIM1; g=*; k=rsa; p=xxx(公開キー)xxxx" ; ----- DKIM example_com_selector for example.com

...
 
##  Domain name[,...]
##      default (none)
##
##  Specify for which domain(s) signing should be done.  No default; must
##  be specified for signing.
 
# Domain                        example.com
Domain                        example.com
 
...
 
##  KeyFile filename
##
##  Specifies the path to the private key to use when signing.  Ignored if
##  Keylist is set.  No default; must be specified for signing.
 
# KeyFile                       /var/db/dkim/example.private
KeyFile                       /etc/dkim/example_com_selector.private
 
##  KeyList filename
##
##  Specifies the path to the list of keys and signing domains to be applied
##  by the signing filter.  The entries in this file should be of the form:
##
##      pattern:domain:keypath
##
##  ...where "pattern" is a pattern of user@host to match, with "*" being
##  allowed as a wildcard; "domain" is the signing domain; and "keypath"
##  is the path to the private key to use to generate signatures for such
##  users.  The selector used will be the filename portion of "keypath".
##  Blank lines are ignored, and the hash ("#") character is interpreted
##  as the beginning of a comment.  See dkim-filter.conf(5) for more
##  information.
 
#KeyList        /etc/mail/dkim-milter/keys/keylist
 
...
 
##  Selector name
##
##  The name of the selector to use when signing.  No default; must be
##  specified for signing.
 
# Selector                my-selector-name
Selector                example_com_selector
 
...
 
##  Socket socketspec
##
##  Names the socket where this filter should listen for milter connections
##  from the MTA.  Required.  Should be in one of these forms:
##
##  inet:port@address           to listen on a specific interface
##  inet:port                   to listen on all interfaces
##  local:/path/to/socket       to listen on a UNIX domain socket
 
# Socket  local:/var/run/dkim-milter/dkim-milter.sock
Socket  inet:8891@127.0.0.1
...

$ chown dkim-milter. /etc/dkim/example_com_selector.private

$ vim /etc/postfix/main.cf
...

# DKIM
milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:127.0.0.1:8891
non_smtpd_milters = inet:127.0.0.1:8891

$ /etc/init.d/dkim-milter start
Starting DomainKeys Identified Mail Milter (dkim-filter):  [  OK  ]
$ /etc/init.d/postfix restart
postfix を停止中:                                          [  OK  ]
postfix を起動中:                                          [  OK  ]

Authentication-Results: xxxx.mail.kks.yahoo.co.jp from=exmaple.com; domainkeys=pass (ok); dkim=pass (ok) header.i=@exmaple.com;
DomainKey-Signature: a=rsa-sha1; s=example_com_selector; d=exmaple.com; c=simple; q=dns; b=xxxx(公開キー);
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=exmaple.com; s=srinfun; t=1338345264; bh=WUs/S8aSRC/sQWX+teNDq9/P/VwCR9oY/5V1Qr4x5rI=; h=To:Subject:Message-Id:Date:From; b=xxxx(公開キー);

Authentication-Results: mail.example.com; dkim=pass (1024-bit key) header.i=@yahoo.co.jp; dkim-adsp=none
Authentication-Results: mail.example.com from=test@yahoo.co.jp; domainkeys=pass
Received: (qmail 92883 invoked by uid 60001); 30 May 2012 02:14:11 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.co.jp; s=yj20110701; t=1338344051; bh=sgeDMsCFY/fqRH9AFEKt6uISCBqq8oqGqd/WfoxdJIQ=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=yyyy(公開キー)
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
  s=yj20110701; d=yahoo.co.jp;
  h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding;
  b=yyyy(公開キー);

...
# AlwaysAddARHeader     no
AlwaysAddARHeader     yes
...

$ /etc/init.d/dkim-milter restart
Shutting down DomainKeys Identified Mail Milter:           [  OK  ]
Starting DomainKeys Identified Mail Milter (dkim-filter):  [  OK  ]

...
Authentication-Results: local.exmaple.com; dkim=none (no signature)
        header.i=unknown; x-dkim-adsp=none
...