opendkim.conf(5) File Formats Manual opendkim.conf(5) (NAME) opendkim.conf - opendkim (LOCATION) /etc/opendkim/opendkim.conf (DESCRIPTION) opendkim(8) DKIM . . . ("#") . (white space) . . (Boolean) . : "T" "t" "Y" "y" "1". : "F" "f" "N" "n" "0". ( ) opendkim(8) . . . opendkim(8) . "dataset" . opendkim(8) . "false" 0 dataset (undefined) . (PARAMETERS) AllowSHA1Only (Boolean) SHA1 . RFC6376 SHA1 SHA256 . SHA256 . AlwaysAddARHeader (Boolean) "Authentication-Results:" "signs all" . DKIM "none" . . AuthservID (string) "authserv-id" Authentication-Results: . MTA . "HOSTNAME" ( gethostname(3) ) . AuthservIDWithJobID (Boolean) "true" authserv-id Authentication-Results: (job ID) . AutoRestart (Boolean) . fork(2) . AutoRestartCount (integer) . . 0 . AutoRestartRate (string) . . n/t[u] n t[u] t u ("s" "S" "m" "M" "h" "H" "d" "D" ). "10/1h" . . Background (Boolean) opendkim fork . "true" . BaseDirectory (string) chdir(2) . . (crash dumps) . BodyLengthDB (dataset) opendkim "l=" . SigningTable ( ) . (mailing list) . . DKIM . BogusKey (string) (forged) . neutral ( "neutral") none ( ) fail ( "fail" ). ( .) CaptureUnknownErrors (Boolean) MTA . Canonicalization (string) () (canonicalization) . DKIM-Signature: . relaxed simple DKIM . simple . ("/") . ChangeRootDirectory (string) . chroot(2) (superuser) . UserID . CheckSigningTable (Boolean) yes SigningTable KeyTable . yes . ClockDrift (integer) . 300 . Diagnostics (Boolean) "z=" . . DiagnosticDirectory (string) "z=" . () . DisableCryptoInit (Boolean) SSL (multi- threaded) . opendkim . DNSConnect (Boolean) (asynchronous resolver) TCP UDP TCP . . DNSTimeout (integer) DNS . 0 . 5 . . (NOTES) . Domain (dataset) . . SigningTable . KeyTable . DomainKeysCompat (boolean) DomainKeys (RFC4870) . . DontSignMailTo (dataset) . "any" . EnableCoredumps (boolean) (core dumps) . . . ExemptDomains (dataset) . PeerList SMTP . ExternalIgnoreList (dataset) "" . "external host (hostname) tried to send mail as (domain)" . PeerList . . FinalPolicyScript (string) Lua . . opendkim-lua(3) . ( .) FixCRLF (Boolean) DKIM CR LF CRLF MTA . . IdentityHeader (string) . ( .) IdentityHeaderRemove (Boolean) IdentityHeader . ( .) IgnoreMalformedMail (boolean) (malformed) . RequiredHeaders ( ) . Authentication- Results . Include (string) . . InternalHosts (dataset) . PeerList . "127.0.0.1" . 127.0.0.1 . KeepAuthResults (boolean) Authentication-Results DKIM ( ) . KeepTemporaryFiles (boolean) . TemporaryDirectory . . KeyFile (string) PEM . KeyTable . Ed25519 SignatureAlgorithm ed25519-sha256 . SignatureAlgorithm . KeyTable (dataset) . KeyFile . : () "d=" () (selector) "s=" () () () . ("%") . ("/") "./" "../" PEM DER base64 "%" . ( SignatureAlgorithm ). SignatureAlgorithm . SigningTable ( ) . RSA Ed25519 KeyTable ( ) SigningTable MultipleSignatures . : # KeyTable (file or inline dataset) rsa-key %:rsa2024:/etc/opendkim/keys/%.rsa.private:rsa-sha256 ed-key %:ed2024:/etc/opendkim/keys/%.ed25519.private:ed25519-sha256 # SigningTable *@example.com rsa-key *@example.com ed-key # opendkim.conf MultipleSignatures yes RSA . Ed25519 DNS RSA . . . Authentication-Results dkim= : Authentication-Results: example.com; dkim=pass header.d=example.com header.s=rsa2024 header.a=rsa-sha256; dkim=fail header.d=example.com header.s=ed2024 header.a=ed25519-sha256 RFC 6376 . . OpenDKIM dkim=fail . Authentication-Results SpamAssassin . . LDAPAuthMechanism (string) LDAP . "simple" . LDAPAuthName (string) SASL LDAP . SASL . . LDAPAuthRealm (string) (realm) SASL LDAP . SASL . . LDAPAuthUser (string) SASL LDAP . SASL . . LDAPBindPassword (string) "bind" LDAP . . LDAPBindUser (string) "bind" LDAP . . LDAPDisableCache (Boolean) LDAP . LDAPKeepaliveIdle (integer) LDAP TCP (keepalive) . LDAP . LDAPKeepaliveInterval (integer) keepalive TCP . LDAP . LDAPKeepaliveProbes (integer) keepalive TCP . LDAP . LDAPTimeout (integer) LDAP . 5 . LDAPUseTLS (Boolean) LDAP TLS . "False" . LogResults (boolean) ( Syslog StdoutLog ) ( "d=" "s=" "b=" ) . LogWhy (boolean) ( Syslog StdoutLog ) . . OPERATIONS opendkim(8) . . MacroList (dataset) MTA . value ( ) . / . value1[|value2[|...]] . MTA . MTA MTA/filter . MTA milter MTA . "file" "csl" . MaximumHeaders (integer) . (DoS) MTA . 65536 0 . MaximumSignaturesToVerify (integer) . . . TrustSignaturesFrom . MaximumSignedBytes (integer) . . BodyLengthDB . MilterDebug (integer) milter . . Minimum (string) (fail). : min min ( min ) min% min min+ min . MinimumKeyBits (integer) . DKIM . 1024 . 0 . Mode (string) . () . s () v (). sv ( opendkim(8) ) v . : () Domain, KeyFile, Selector, KeyTable, SigningTable () KeyTable, SigningTable, Domain, KeyFile, Selector () KeyTable, SetupPolicyScript, Domain, KeyFile, Selector. MTA (dataset) MTA ( DaemonPortOptions Name sendmail(8) ) . MTA / . MTACommand (string) SendReports . /usr/sbin/sendmail . sendmail(8) "-t" ( ) "-f" ( ) . MultipleSignatures (Boolean) . SigningTable . MustBeSigned (dataset) DKIM . . . Nameservers (string) IP DNS DKIM VBR . /etc/resolv.conf . NoHeaderB (Boolean) "header.b" Authentication-Results . "false" . OmitHeaders (dataset) . DKIM . DKIM ( RFC6376 5.4) "" (SHOULD NOT) (Return-Path, Received, Comments, Keywords, Bcc, Resent-Bcc DKIM-Signature). "." ( ) . "*" "*,+foobar" "foobar" "*,-Bcc" "Bcc" . On-BadSignature (string) . ( ): accept (a) discard (d) quarantine (q) reject (r) tempfail (t) (temp-fail). accept . "t" () DKIM Authentication- Results . On-Default (string) . "On-" . On-DNSError (string) DNS . On-BadSignature . tempfail . On-InternalError (string) . On-BadSignature . tempfail . On-KeyNotFound (string) DNS . On-BadSignature . accept . On-NoSignature (string) . On-BadSignature . accept . On-Security (string) . On-BadSignature . tempfail . On-SignatureError (string) . On-BadSignature . reject . OversignHeaders (dataset) ( "h=") . . . . . RFC5322 ( From) RFC5322 . SignHeaders . RFC6376 5.4 . PeerList (dataset) "" (peers) . ( ".example.com") IP IPv6 ( IPv4) IP CIDR ( "192.168.1.0/24") . ("!") "not" () . IP IPv6 . "192.168.1.1" "!192.168.1.0/24" . IPv6 (RFC5952) . CIDR 0 ( "10.0.0.1/8" ). IPv6 CIDR inet_ntop(3) "::" ( "0:0:0:0:0:0:0:1" ). IP () ( ) . : IPv6 opendkim.conf IPv6 ( "fd00:368::/40") "type:" ( "file:", "ldap:") . IPv6 file: : PeerList file:/etc/opendkim/peerlist.txt peerlist.txt IPv6 CIDR. PidFile (string) (PID) . POPDBFile (dataset) IP . POP-before-SMTP . ( .) Quarantine (Boolean) MTA . ( milter .) QueryCache (Boolean) DKIM DNS . . ( .) RedirectFailuresTo (address) . . . RemoveARAll (Boolean) Authentication-Results: RemoveARFrom . DKIM . RemoveARFrom (dataset) Authentication- Results: . (canonical) . ( "host.example.com") ( ".example.com") . RemoveOldSignatures (Boolean) . ReplaceHeaders (data set) ReplaceRules . . ( .) ReplaceRules (string) MTA . From: "masquerade" MTA . POSIX (ASCII 9) . '#' . . ( .) ReportAddress (string) From: ( SendReports ). . ReportBccAddress (string) () Bcc: ( SendReports ). . RequestReports (boolean) . ( RFC6651 .) RequiredHeaders (boolean) RFC5322 . . RequireSafeKeys (boolean) . "true" . "true" . ResignAll (boolean) ResignMailTo (re-signing) ( ) ( ). ( .) ResignMailTo (dataset) . "." . KeyTable ( ) . KeyTable . ( .) ResolverConfiguration (string) . Unbound . . ResolverTracing (Boolean) (resolver tracing) . . OpenDKIM . ScreenPolicyScript (string) Lua DKIM . . opendkim-lua(3) . ( .) SelectCanonicalizationHeader (string) . Canonicalization . "X-Canonicalization" . Selector (string) (selector) . DKIM . SigningTable . KeyTable . SenderHeaders (dataset) . . () . "From" . OmitHeaders . SenderMacro (string) milter . ( .) SendReports (Boolean) true ("r=y") ( ra=user) DNS . RFC6651 . SetupPolicyScript (string) Lua . DKIM . opendkim-lua(3) . ( .) SignatureAlgorithm (string) . 'opendkim -V' . rsa-sha256 rsa-sha1 . KeyFile KeyTable . Ed25519 ed25519-sha256 . SignatureTTL (integer) (TTL) . . SignHeaders (dataset) . DKIM . DKIM " " (RFC6376 5.4.1) (From, Reply-To, Subject, Date, To, Cc, Resent-Date, Resent-From, Resent-Sender, Resent-To, Resent-Cc, In-Reply-To, References, List-Id, List-Help, List-Unsubscribe, List- Subscribe, List-Post, List-Owner, List-Archive). "*" "*,+foobar" "foobar" "*,-Bcc" "Bcc" . SigningTable (dataset) From: . KeyTable ( ) "i=" . "i=" ( "d=") . "%" From: . "%" From: . ("refile") From: . . user@host host user@.domain ( "foo.example.com" "user@foo.example.com" "user@.example.com" "user@.com" ) .domain user@* *. MultipleSignatures . SMTPURI (string) URI ( "smtp://localhost") SMTP . ( .) Socket (string) sendmail(8) . socketspec : local:path path inet:port[@host] inet6:port[@host] TCP port . host IP . IP () . . SoftStart (Boolean) LDAP SQL . "False" . SoftwareHeader (Boolean) opendkim "DKIM-Filter" . . Mode ( ). Statistics (filename) DKIM . opendkim-stats(8) SQL opendkim-importstats() . ( .) StatisticsName (string) . gethostname(3) . ( .) StatisticsPolicyScript (string) DKIM . . StatisticsPrefix (string) AnonymousStatistics . . StrictHeaders (Boolean) DKIM RFC5322 3.6 . StrictTestMode (Boolean) CRLF ( -t opendkim(8) ) CRLF . SubDomains (Boolean) Domain . Syslog (Boolean) syslog(3) . SyslogFacility (string) syslog(3) . syslog.conf(5) . "mail" . SyslogName (string) syslog(3) . . "opendkim". SyslogSuccess (Boolean) syslog(3) . StdoutLog (Boolean) . SyslogSuccess Syslog . TemporaryDirectory (string) . libopendkim /tmp . TestDNSData (data set) DNS TXT . . TestPublicKeys (string) . . TrustAnchorFile (string) (trust anchor) DNS DNSSEC . Unbound http://unbound.net . TrustSignaturesFrom (dataset) . From: . . UMask (integer) . Socket PidFile ( ) mkstemp(3) umask . umask(2) . UnprotectedKey (string) DNS ( DNSSEC) . neutral ( "neutral") none ( ) fail ( "fail"). ( .) UserID (string) userid . userid[:group] . userid group . VBR-Certifiers (string) X-VBR-Certifiers . ( .) VBR-PurgeFields (string) X-VBR-Certifiers X-VBR-Type . ( .) VBR-TrustedCertifiers (string) VBR-Info. ( .) VBR-TrustedCertifiersOnly (Boolean) ( ) VBR-Info (vouching) . . ( .) VBR-Type (string) VBR X-VBR-Type . ( .) WeakSyntaxChecks (Boolean) . From: . (NOTES) DNS ( DNSTimeout ) sendmail . MTA DNS . IPv4 CIDR inet_addr(3) . ( "192.0.2/24" "192.0.2.0/24" ). (FILES) /etc/opendkim/opendkim.conf . (VERSION) 2.11.0 opendkim . (COPYRIGHT) Copyright (c) 2007, 2008, Sendmail, Inc. and its suppliers. All rights reserved. Copyright (c) 2009-2015, The Trusted Domain Project. All rights reserved. (SEE ALSO) opendkim(8), opendkim-lua(3), sendmail(8) RFC5451 - Message Header Field for Indicating Message Authentication Status RFC5617 - DKIM Author Domain Signing Practises RFC5965 - An Extensible Format for Email Feedback Reports RFC6008 - Authentication-Results Registration for Differentiating among Cryptographic Results RFC6376 - DomainKeys Identified Mail RFC6651 - Extensions to DomainKeys Identified Mail (DKIM) for Failure Reporting The Trusted Domain Project opendkim.conf(5)