使用amavisd-new作DKIM簽名驗證失敗解決

郵件服務器使用amavisd-new來簽署DKIM，發現發往gmail的郵件DKIM驗證失敗

Authentication-Results: mx.google.com; spf=pass (google.com: domain of mark@myhost.com designates 61.128.xxx.xxx as permitted sender) smtp.mail=mark@myhost.com; dkim=neutral (bad format) header.i=@myhost.com

安裝郵件服務器當時調試是成功驗證了的。

因而研究發現 amavisd.conf中dkim_key配置決定接收服務器去查詢發送服務器DKIM公鑰的變量：

#!! the 2rd param is for DNS TXT recorde like dkim._domainkey

#if use other word eg. issence,then DNS TXT hostname must be issence._domainkey !!!

dkim_key('myhost.com', 'dkim', '/var/amavis/myhost-dkim.key');

如上，粗體的dkim決定你本身服務器域名保存DKIM的TXT記錄中的主機名必須是

dkim._domainkey.myhost.com

我在DNS記錄中保存的是dkim._domainkey.myhost.com但amavisd中卻不是dkim這個標誌符，不知道何時被改爲了mail，因而致使接受服務器查詢DNS記錄失敗，而且使用amavisd自帶命令驗證也失敗：

# amavisd testkeys TESTING#1: mail._domainkey.myhost.com => invalid (public key: not available)

修改amavisd.conf中相關位置爲dkim因而驗證成功：

# amavisd testkeys

TESTING#1: dkim._domainkey.myhost.com => pass

如下是gmail收信後郵件信頭：

Authentication-Results: mx.google.com; spf=pass (google.com: domain of mark@myhost.com designates 61.128.xxx.xxx as permitted sender) smtp.mail=mark@myhost.com; dkim=pass header.i=@myhost.com

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=myhost.com; h= content-transfer-encoding:content-type:content-type:subject :subject:mime-version:user-agent:from:from:date:date:message-id :received:received; s=dkim; t=1322140024; x=1323954425; bh=uZ....Hy9hw=; b=Vq/2zo.....ztTOwVc=

注：文中以myhost代替實際域名tld部分