Configurating DKIM and SPF, key not secured

Jerome

2/20/24, 7:58 AM

On a Ubuntu 20.04 VPS, installing opendkim via sudo apt install opendkim opendkim-tools proceeds as expected, following the steps provided here.

However, upon testing, while e-mails get sent in practice to the targetted mailbox with a very low spam score (3.9) and thus percolate outside of spam filetering,

sudo opendkim-testkey -d domain.tld -s default -vvv

returns unexpected and somewhat contradictory conclusions:

opendkim-testkey: key not secure
opendkim-testkey: key OK

The key is OK, but not secure. This puts into doubt the 'OK' bit. What has to be done to make the key secure?

Update

Following suggestion in comments, contents of opendkin.conf follow:

Syslog                  yes
Logwhy                  yes
UMask                   007

Canonicalization        relaxed/simple
Mode                    sv
SubDomains              no

AutoRestart         yes
AutoRestartRate     10/1M
Background          yes
DNSTimeout          5
SignatureAlgorithm  rsa-sha256
Socket                  local:/run/opendkim/opendkim.sock
PidFile               /run/opendkim/opendkim.pid
OversignHeaders         From
TrustAnchorFile       /usr/share/dns/root.key

include
UserID                opendkim
KeyTable           refile:/etc/opendkim/key.table
SigningTable       refile:/etc/opendkim/signing.table
ExternalIgnoreList  /etc/opendkim/trusted.hosts
InternalHosts       /etc/opendkim/trusted.hosts

0 + 4

ubuntu

dkim

opendkim

Gerald Schneider

2/20/24, 8:18 AM

Does this answer your question? [opendkim-testkey: key not secure](https://serverfault.com/questions/1048491/opendkim-testkey-key-not-secure)

Jerome

2/20/24, 8:41 AM

alas, not, as the conf file already has `TrustAnchorFile /usr/share/dns/root.key` set

Gerald Schneider

2/20/24, 8:52 AM

Do you have dnssec configured in your DNS records?

Jerome

2/20/24, 9:10 AM

Ah, no. So that explains the situation. Do you have a judgement call on criticality of said entry?

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Configurating DKIM and SPF, key not secured

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.