Well, don't I feel dumb...
I wrote in my original post that nothing was being logged to /var/log/qpsmtpd/current when I sent a message. I didn't see anything at the time, but when I try now there definitely is stuff logged there (maybe I was inadvertently looking at the wrong file?). That led me to permissions on the .private file; once I fixed them, it now works. Lessons learned:
- You must have a copy of the dkim.private file for every domain, including your primary domain, for which you want to send DKIM-signed mail, as domain.tld.private. The wiki page does say this, but I'd originally misread it as applying only to additional domains.
- The *.private files must be readable by the qpsmtpd user
The way I got here was by creating dkim.private, copying it to domain2.tld.private and domain3.tld.private, extracting the public key, and changing ownership on the dkimkeys directory to qpsmtpd:qpsmtpd. Then, once I realized my error from the first bullet point, I made another copy of dkim.private to domain1.tld.private, and did not change ownership on that file, so it was owned by root:root with permissions of 600.
With that said, the wiki calls for permissions on that file to be 700. Doesn't seem to me that the execute bit needs to be set. Is there a reason for that?
18 Replies
6453 Views