CentOS5 安裝 SPF/DKIM 郵件認證

SPF (Sender Policy Framework)
DKIM (DomainKeys Identified Mail)

安裝前先確認已經安裝以下套件

yum install openssl openssl-devel sendmail sendmail-devel

設定 SPF 只是在 DNS 內增加兩行有關 mail server 的定義

連上 http://www.openspf.org/Project_Overview 使用 Deploying SPF 來快速產生你的 SPF 在 DNS 需要的資料.
Exp: everplast.net → http://old.openspf.org/wizard.html?mydomain=everplast.net&submit=Go!

產生給 BIND 的資訊:

everplast.net. IN TXT "v=spf1 a mx include:everplast.com.tw include:e-plast.com.tw ~all"
mail.everplast.net. IN TXT "v=spf1 a -all"

在 everplast.net 的 DNS 定義檔 ¹⁾ 增加這兩行

;
; Mail Server
;
@                       A       192.168.0.250
@               IN      MX      10 mail
everplast.net. IN TXT "v=spf1 a mx include:everplast.com.tw include:e-plast.com.tw ~all"
mail            IN      A       192.168.0.251
mail            IN      MX      10 mail
mail.everplast.net. IN TXT "v=spf1 a -all"
;

定義完成後, 重新啟動 named
```
service named restart
```

使用 nslookup 確認設定是否正確

[root@ag320-mail data]# nslookup
> set type=TXT
> everplast.net
Server:         192.168.0.251
Address:        192.168.0.251#53
 
everplast.net   text = "v=spf1 a mx include:everplast.com.tw include:e-plast.com.tw ~all"
> mail.everplast.net
Server:         192.168.0.251
Address:        192.168.0.251#53
 
mail.everplast.net      text = "v=spf1 a -all"

透過 mail.everplast.net 寄信到 check-auth@verifier.port25.com 可得到設定結果的回信. 內容如:

:
Summary of Results
==========================================================
SPF check:          pass
DomainKeys check:   neutral
DKIM check:         neutral
Sender-ID check:    pass
SpamAssassin check: ham
:

dkim-milter 已經改由 OpenDKIM 專案取代
參考網址
1. http://sourceforge.net/projects/dkim-milter/
2. http://opendkim.org/

透過 rpmforge 直接安裝

yum install opendkim

================================================================================
 Package            Arch          Version                 Repository       Size
================================================================================
Installing:
 opendkim           x86_64        2.5.2-1.el5.rf          rpmforge        259 k
Installing for dependencies:
 libopendkim        x86_64        2.5.2-1.el5.rf          rpmforge        164 k

到 http://www.socketlabs.com/services/dkwiz 產生 Domain Key / DKIM Key Exp:
```
Domain : e-plast.com.tw
Selector : key2
```

將產生結果的 Private Key 貼到 mail server 內的 /etc/opendkim/keys/e-plast.com.tw/key2 並設定權限

mkdir -p /etc/opendkim/keys/e-plast.com.tw
vi /etc/opendkim/keys/e-plast.com.tw/key2
chmod 600 /etc/opendkim/keys/e-plast.com.tw/key2
chown -R opendkim:opendkim /etc/opendkim/keys

將產生結果的 domainkey 放入 e-plast.com.tw DNS 定義檔內

;
; Mail Server
;
@                       A       220.130.139.7
@               IN      MX      10 mail
e-plast.com.tw. IN TXT "v=spf1 a mx include:e-plast.com.tw ~all"
mail            IN      A       220.130.139.7
mail            IN      MX      10 mail
mail.e-plast.com.tw. IN TXT "v=spf1 a -all"
_domainkey.e-plast.com.tw.      IN TXT  "t=y;o=~;"
key2._domainkey.e-plast.com.tw. IN TXT  "k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDlbTzfHiT8i11cZGW4WbFtgjEdB/S9HqK8CwmlDA011/vngx9/27DGWXdqGaq4bMosnt6TJuUHaVRLMgXFI9Tap3m0Ob1ioggocECEnJ1xjUdKMamhBCjLoqSQVV2DyOYyfxB3y+xdkfBo7NYwob8C7bDD51oYPrA5drwPyuRErQIDAQAB"
;

編輯相關 mail domain name 清單

vi /etc/opendkim/TrustedHosts

127.0.0.1
localhost
mail.e-plast.com.tw
e-plast.com.tw

修改 /etc/opendkim.conf

vi /etc/opendkim.conf

:
Mode    sv
:
Socket  inet:8891@localhost
:
Canonicalization        relaxed/simple
:
#Domain  e-plast.com.tw
:
#Selector                key2
:
#KeyFile /etc/opendkim/keys/e-plast.com.tw/key2
:
KeyTable        /etc/opendkim/KeyTable
:
SigningTable    /etc/opendkim/SigningTable
:
InternalHosts   refile:/etc/opendkim/TrustedHosts
:

當發現時常因為驗簽章失敗退別人的信, 想關閉驗簽失敗退信的功能可修改一下參數:

:
On-Default              reject
On-BadSignature         accept
On-DNSError             tempfail
:

修改 /etc/opendkim/KeyTable

vi /etc/opendkim/KeyTable

:
key2._domainkey.e-plast.com.tw e-plast.com.tw:key2:/etc/opendkim/keys/e-plast.com.tw/key2

修改 /etc/opendkim/SigningTable

vi /etc/opendkim/SigningTable

:
*@e-plast.com.tw key2._domainkey.e-plast.com.tw
*@mail.e-plast.com.tw key2._domainkey.e-plast.com.tw
:
e-plast.com.tw key2._domainkey.e-plast.com.tw
mail.e-plast.com.tw key2._domainkey.e-plast.com.tw

啟動 opendkim 服務

service opendkim start
chkconfig opendkim on

[root@e-plast-mail keys]# service opendkim restart
Stopping OpenDKIM Milter:                                  [  確定  ]
Generating default DKIM keys:                              [警告]
Cannot determine host's domain name, so skipping default key generation.
Starting OpenDKIM Milter:                                  [  確定  ]

如果覺得這樣的訊息很礙眼, 可以在 keys 目錄內產生 default.private 檔, 可用之前的 key2 建立連結方式, 執行以下語法來解決

cd /etc/opendkim/keys
ln -s e-plast.com.tw/key2 default.private

更改 sendmail 使用 dkim 服務

vi /etc/mail/sendmail.mc

:
:
INPUT_MAIL_FILTER(`opendkim', `S=inet:8891@localhost')

cd /etc/mail
mv sendmail.cf sendmail.cf.back1
m4 sendmail.mc > sendmail.cf

重新啟動 MailServer
```
service MailScanner restart
```

下載安裝 dkim-milter

使用原始碼安裝程序

wget http://downloads.sourceforge.net/project/dkim-milter/DKIM%20Milter/2.8.3/dkim-milter-2.8.3.tar.gz
tar -zxvf dkim-milter-2.8.3.tar.gz
cd dkim-milter-2.8.3
cp site.config.m4.dist site.config.m4
vi site.config.m4

:
define(`bld_LIBDKIM_SHARED', `true')
:
dnl OpenSSL -- cryptography library
APPENDDEF(`confINCDIRS', `-I/usr/include/openssl ')
APPENDDEF(`confLIBDIRS', `-L/usr/lib ')
:
dnl libmilter -- Sendmail's milter library
APPENDDEF(`bld_dkim_filter_INCDIRS', `-I/usr/include/libmilter')
APPENDDEF(`bld_dkim_filter_LIBDIRS', `-L/usr/lib')
:

cp site.config.m4 devtools/Site/
sh Build
sh Build install
 
(http://brneurosci.org/linuxsetup97.html)  --- //[[[email protected]|蔡宗融]] 2009-08-06 06:43//

使用 rpm 安裝程序

wget https://www.ichiayi.com/wiki_file/dkim-milter-2.8.3-1.x86_64.rpm
rpm -ivh dkim-milter-2.8.3-1.x86_64.rpm

到 http://www.socketlabs.com/services/dkwiz 產生 Domain Key / DKIM Key Exp:
```
Domain : everplast.net
Selector : key1
```

將產生結果的 Private Key 貼到 mail server 內的 /etc/mail/dkim/keys/everplast.net/key1 並設定權限

mkdir -p /etc/mail/dkim/keys/everplast.net
vi /etc/mail/dkim/keys/everplast.net/key1
chmod 600 /etc/mail/dkim/keys/everplast.net/key1
chown -R dkim-milt:dkim-milt /etc/mail/dkim/keys

將產生結果的 domainkey 放入 everplast.net DNS 定義檔內

;
; Mail Server
;
@                       A       192.168.0.250
@               IN      MX      10 mail
everplast.net. IN TXT "v=spf1 a mx include:everplast.com.tw include:e-plast.com.tw ~all"
mail            IN      A       192.168.0.251
mail            IN      MX      10 mail
mail.everplast.net. IN TXT "v=spf1 a -all"
_domainkey.everplast.net.       IN TXT  "t=y;o=~;"
key1._domainkey.everplast.net.  IN TXT  "k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDNPwPm7Q/OONldTMPV8pkXbmSXqxyMCGbQu9bBqK8HtsNZzqxE1kyFCiQ/7BJ6W9CK82pOtP97Z8XyoEp2JDSxNkSTr/36kIaAkzmZhWpsNYhZLNhD707XunD27BpNWtDIMc2wdGMHUq3ErghUUuDkiC7pTNjz9L9E2Q+EzxXZpwIDAQAB"
;

編輯相關 mail domain name 清單

vi /etc/mail/dkim/trusted-hosts

mail.everplast.net
everplast.net
mail.e-plast.com.tw
e-plast.com.tw
mail.everplast.com.tw
everplast.com.tw
localhost
127.0.0.1

修改 /etc/dkim-filter.conf

vi /etc/dkim-filter.conf

:
Canonicalization        simple/simple
:
Domain                  everplast.net
:
KeyFile /etc/mail/dkim/keys/everplast.net/key1
:
Selector                key1
:
Socket                  inet:8891@localhost
:
Mode                    sv
:
InternalHosts           /etc/mail/dkim/trusted-hosts
:

當發現時常因為驗簽章失敗退別人的信, 想關閉驗簽失敗退信的功能可修改一下參數:

:
On-Default              reject
On-BadSignature         accept
On-DNSError             tempfail
:

修改 /etc/mail/dkim/keylist

vi /etc/mail/dkim/keylist

:
*@everplast.net:everplast.net:/etc/mail/dkim/keys/everplast.net/key1

啟動 dkim-milter 服務

service dkim-milter start
chkconfig dkim-milter on

更改 sendmail 使用 dkim 服務

vi /etc/mail/sendmail.mc

:
:
INPUT_MAIL_FILTER(`dkim-filter', `S=inet:8891@localhost')

cd /etc/mail
mv sendmail.cf sendmail.cf.back1
m4 sendmail.mc > sendmail.cf

重新啟動 MailServer
```
service MailScanner restart
```

如果有使用 MailScanner, 在 /etc/MailScanner/MailScanner.conf 內的 Sign Clean Messages 要設定 no

Sign Clean Messages = no

否則收信端檢核信件 dkim 簽章時會驗簽失敗, 出現 dkim=fail 的狀況.

mail, 安裝, 郵件, install mail

¹⁾

/var/named/data/internal.everplast.net , /var/named/data/named.everplast.net

Num	Page	Accesses
1	tech:fortigate_tips	757
2	tech:win10_hash	669
3	start	439
4	tech:ubuntu_xrdp	421
5	tech:pvetips	353
6	tech:nfs	325
7	tech:sqlsrv	266
8	tech:zfs	205
9	tech:win10snmpd	204
10	tech:pbstips	201

CentOS5 安裝 SPF/DKIM 郵件認證

- 設定 SPF 方式

- 安裝與設定 DKIM 方式

OpenDKIM

DKIM-Milter

參考網址