Configuring OpenKIM Signing Outgoing Emails with SMTP on Ubuntu 20.04
OpenKIM (Key Internet Mailer) is a widely-used email signing and encryption tool that uses the DKIM (DomainKeys Identified Mail) standard to ensure the authenticity and integrity of outgoing emails. This article will guide you through the process of installing OpenKIM, generating keys, and configuring SMTP to automatically send DKIM-signed emails on Ubuntu 20.04.
Prerequisites
Before you begin, make sure you have the following:
- A server running Ubuntu 20.04
- SMTP (Simple Mail Transfer Protocol) installed and configured
- Root or sudo access to the server
Installing OpenKIM
To install OpenKIM, you will need to add the OpenKIM PPA (Personal Package Archive) to your server and install the opendkim package. Run the following commands:
sudo add-apt-repository ppa:opendkim/opendkim
sudo apt update
sudo apt install opendkim opendkim-toolsGenerating Keys
Next, you will need to generate a new DKIM key pair. The private key will be used to sign outgoing emails, and the public key will be published in your DNS records. Run the following command to generate the key pair:
sudo opendkim-genkey -s default -d yourdomain.comReplace yourdomain.com with your actual domain name. This will generate two files: default.private and default.txt. The private key should be kept secret and stored in a secure location, while the public key should be published in your DNS records.
Configuring SMTP to Use OpenKIM
To configure SMTP to use OpenKIM, you will need to edit the SMTP configuration file. The location of this file may vary depending on your SMTP implementation, but it is typically located at /etc/postfix/main.cf or /etc/exim4/exim4.conf.template.
Add the following lines to the SMTP configuration file:
MilterSocketListen /run/opendkim/opendkim.sock
MilterSocketConnectTimeout 10s
SMTPOptions = p, TLS_Policy=opendkim
These lines tell SMTP to listen for connections from OpenKIM on the /run/opendkim/opendkim.sock socket, set a timeout of 10 seconds, and use the OpenKIM TLS policy for outgoing emails.
Configuring OpenKIM
Finally, you will need to configure OpenKIM to use the private key you generated earlier and sign outgoing emails. Edit the OpenKIM configuration file, typically located at /etc/opendkim.conf, and add the following lines:
KeyFile /path/to/default.private
Selector default
SigningTable refile:/etc/opendkim/signing_table
ExternalIgnoreList refile:/etc/opendkim/trusted_hosts
Replace /path/to/default.private with the actual path to the private key file. The Selector and SigningTable options tell OpenKIM which key to use and which emails to sign. The ExternalIgnoreList option specifies a list of hosts that should be ignored when signing emails.
In this article, you have learned how to install OpenKIM, generate keys, and configure SMTP to automatically send DKIM-signed emails on Ubuntu 20.04. This will help ensure the authenticity and integrity of your outgoing emails and protect your domain from spoofing and phishing attacks.