DKIM not working

Hello Hagman!

 Thank you for contacting the Sophos Community!

What is the output of dig nameofthekey._domainkey.domain.com TXT +short

Regards,

"v=DKIM1;k=rsa;t=y;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPSj8NGDf71/tmIKyJ3Ymbdgx4IGGxGVQCvj97AhN50uKw6qBpkMNBA8JCz0f4LfyV/2OM7R+WXSKtt/5cQD5mbYQku/5wbjqTJJDMVvBk10TAp636Z/s+zQC9/piaLAzqv/DSnGnxCXAzxK8rxdK5fetzAkf8Iw9vb2ChbbVjDwIDAQAB"

(cf. the equivalent host command in my post)

Does that even matter? I mean, a problem with the DNS record would certainly lead to failure in verification of the DKIM signature at the receiving end - but the DKIM signature is not even applied! at my sending end?

In other words: Does your question mean that UTM does the DKIM signing if it is able to verify that the corresponding public key DNS record (which i dnot needed for the signing per se) is resolvable from the (internal-ish) resolver of the UTM instead of merely from all receiving ends who resolve the "official" version of DNS?

"v=DKIM1;k=rsa;t=y;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPSj8NGDf71/tmIKyJ3Ymbdgx4IGGxGVQCvj97AhN50uKw6qBpkMNBA8JCz0f4LfyV/2OM7R+WXSKtt/5cQD5mbYQku/5wbjqTJJDMVvBk10TAp636Z/s+zQC9/piaLAzqv/DSnGnxCXAzxK8rxdK5fetzAkf8Iw9vb2ChbbVjDwIDAQAB"

(cf. the equivalent host command in my post)

Does that even matter? I mean, a problem with the DNS record would certainly lead to failure in verification of the DKIM signature at the receiving end - but the DKIM signature is not even applied! at my sending end?

In other words: Does your question mean that UTM does the DKIM signing if it is able to verify that the corresponding public key DNS record (which i dnot needed for the signing per se) is resolvable from the (internal-ish) resolver of the UTM instead of merely from all receiving ends who resolve the "official" version of DNS?

Hello Hagman,

Then you would need to check /var/log/smtp.log for one of the outbound emails to see what it says about the signing.

Regards,

At first  thought that no error were logged, but then O found a separate entry

    DKIM: signing failed (RC -101)

I don't know what that means though (Google only ever heard of RC -102)

Hello Hagman,

I was digging for a while but couldn't find anything.

My guess is that it has to do with the key length, but it is 1024 which should be good enough, I would ask you to create a new one maybe try going higher to 2048.

If it still fails please open a case with Support to get this investigated further, you can tell them you created a 1024 and a 2048 but it remains the same, also please provide them with the any KB you have followed and the output of the /var/log/smtp.log where it shows that error. 

Regards,

Thank you,

I did as suggested, created a 2048bit key - no change (no signature added, error "RC -101") .

I think I meanwhile stumbled about another thread about DKIM problem and they solved it quite unconventionally: by rebooting the firewall. I will give that a try tonight and otherwise try to open a case.

Thanks again

Hello Hagman,

Thank you for the follow-up!

Let me know if the reboot fixed the issue, or if you opened the case please share with me the Case ID so I can follow-up!

Regards,