Re: DKIM implementation isue

From: Rolf E. Sonneveld <>
Date: Thu, 24 Jan 2013 19:55:15 +0100

Hi, Lucas,

On 01/24/2013 05:14 PM, L.W. van Braam van Vloten wrote:
> Dear list,
> I would appreciate some advice on setting up DKIM on my mailserver.
> I am running a standard Debian 6 box using the default Postfix and
> dkim-filter packages. Postfix is configured to use amavisd-new for
> spam- and virus filtering.

First of all, see the comment of Scott: dkim-milter is no longer
maintained actively, while opendkim is.

> I have followed the instructions at
> where:
> My selector is "list"
> My domain name is ""
> I have added the following records to my DNS "" zonefile:
> _domainkey.list IN TXT "t=n;o=~"

Not sure what you want to achieve here. According to the value of 't=' can be either 'y'
or 's'. Furthermore, there is no 'o' tag. Also, this is not the right
place in DNS for a key in relation to a signature for

> list._domainkey.list IN TXT "g=*; k=rsa;
> p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDRIUfe6fct5L75N0M2SOLVUE16THGX62egUTSj8mzi8uFjO6+ZuI9F8G7sIaHhHQ6RITrqYvH7cNxU2VWhqV9UobEs3ZecCkzThDewdloUmZ0oOkHGmE6zlNnodRcbfP+1VxMNC2KTHhSc8ONk3hlYuI6zyTxkU68Kg7kpajNXjQIDAQAB"
> Mail sent to an address contains the following header:
> DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;;
> s=list.private; t=1359040840;

It seems from this signature that your selector is 'list.private', not

> bh=g3zLYH4xKxcPrHOD18z9YfpQcnk/GaJedfustWU5uGs=;
> h=Date:From:To:Subject:Message-ID:MIME-Version:Content-Type:
> Content-Transfer-Encoding;
> b=aGYNtCgjRv45NOT+lR2r+PpzeBmSthzDKLiG7XIig//N2qpUxFEmUmscOoeYhr7Bm
> uIxaL5dA0KcArlEheEIL66Yfx+Z5Zggdz5cSBMnjmFXyULgramQExWn1y8sSjdw1Xm
> zZsr9UHvt2ZQ/O+Xn1yPc8cnXRyOA/fy52xMCaBM=
> The test at says: "This is a valid DKIM
> key record"
> However this does not work properly:
> - When I test "" at
> gives me the result:
> "This selector is in error: Tag 'p': Invalid public key has no modulus"
> - mail sent from my server to an address contains the header:
> Authentication-Results:
>; domainkeys=neutral (no sig);
>; dkim=permerror (no key)

If Yahoo is encountering a DKIM signature with 's=list.private', it will
look for a key at Periods in
selectors are explicitly allowed as per RFC6376, see the text and
rationale in par. 3.1 of the RFC.

> - Mail sent from my server to an address contains the header:
> Authentication-Results:;
> spf=pass ( domain of
> designates as permitted sender)
> dkim=neutral (bad format)
> I am at a loss... Dear list, please help me: any ideas?

To further complicate things: is this domain used for mailing lists (as
the domainname and your website seems to imply)? Then
you may want to have a look at, as
mailing lists often break an already present DKIM-signature due to
modification of Subject and/or adding a footer section. Not sure about
LISTSERV, has there been work ongoing to support DKIM in Listserv?


Rolf E. Sonneveld
Sonnection B.V.
Received on Thu Jan 24 2013 - 18:55:34 PST

This archive was generated by hypermail 2.3.0 : Thu Jan 24 2013 - 19:00:01 PST