This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DKIM Problem

I have 2 NIC's with 2 different ISP's (so 2 different IP's). Let's call ISP 1 "WAN 1" and ISP 2 "WAN 2". I'm not allowed ( I can't send or receive) to use a mailserver on WAN 1, so I can only use WAN 2 to send and receive mail. I've enabled Uplink balancing set WAN 1 as first and WAN 2 as second and auto monitoring. Then I made a Multipath Rule: Any->SMTP->Any (by Interface)-> WAN 2.
Then I used the DKIM how to from the Knowledge base and followed all the steps and tests and that worked fine. I have 3 domains which I use. On all zones of the domains I copied the public key, so this should not be a problem.
I can send and receive mail. But when I send to my account at Yahoo.com (which supports Domain Keys) it shows the following:

From Me Wed Apr  8 20:45:36 2009
Return-Path:
Authentication-Results: mta170.mail.re4.yahoo.com  from=mydomain.com; domainkeys=neutral (no sig); from=; dkim=temperror(d2i_PUBKEY_bio() failed)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
    d=mydomain.com; s=dkim; h=From[:D]ate:To:Message-ID:Subject:
    MIME-Version:Content-type; bh=9LQyMGjDaGPWKTjCng3s3gwVUvcAIHW4dU
    IjbM/m2XA=; b=rjGVsjRn6ZSDWE3KZ2OCWnR+z5j+Xd4FIqyMM5Zlir+288q29f
    y8ZPuW+69yiuZ82TZeUw4UIFBSIeO3qfPGL8z9emLCAwztA4Pzg2B5RwGjnYjqux
    w5yCtstU7uO6c8CA4FHvULRUr5cqzIIdq3W7KlDwrYwjn8h0N5E1tX3hU=

Also when I send a test e-mail to sa-test@sendmail.net and get the following error:
Authentication System:       DomainKeys Identified Mail
   Result:                   DKIM signature confirmed BAD
   Description:              Unrecoverable error during processing; signature data cannot be verified
   Reporting host:           sendmail.net
   More information:         Domain Keys Identified Mail (DKIM)
   Sendmail milter:          https://sourceforge.net/projects/dkim-milter/

Does anyone know where this problem is caused, so in Astaro or on my DNS server?

This thread was automatically locked due to age.

Parents

0 BAlfson over 16 years ago

Fobe, did this work correctly before you enabled Uplink Balancing?

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 PabloDiablo over 16 years ago in reply to BAlfson

Not tried, because WAN 2 is added later and I can't use/test e-mail traffic on WAN 1. But I think what you're idea is: disable WAN 1 and then use only WAN2 and see if the error is still there, am I right?
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 PabloDiablo over 16 years ago in reply to BAlfson

Not tried, because WAN 2 is added later and I can't use/test e-mail traffic on WAN 1. But I think what you're idea is: disable WAN 1 and then use only WAN2 and see if the error is still there, am I right?
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 BAlfson over 16 years ago in reply to PabloDiablo

Good idea. I was just trying to eliminate that as a cause, and if it had worked before, that would have done it.

From my understanding, DKIM shouldn't depend on the sender's IP like SPF does.

I created a "Configuring DKIM" document last year that's probably too elementary for you, but reading it might give you an idea. Click on my name to send me an email, and I'll send it to you. I would appreciate any suggestions/corrections.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 PabloDiablo over 16 years ago in reply to BAlfson

oooops, I just found out what the problem is! In my private key where still some "/" which I didn't see (it's very small) in the 1st place... Now everything is working fine!
Cancel
Vote Up 0 Vote Down

Cancel
0 PabloDiablo over 16 years ago in reply to PabloDiablo

Well, it looks that DKIM is working but when I send a test e-mail to auth-results@verifier.port25.com, I get the following report:

Authentication-Results: verifier.port25.com smtp.mail=fobe@mydomain.com; mfrom=pass;
Authentication-Results: verifier.port25.com header.From=fobe@mydomain.com; domainkeys=neutral (message not signed);
Authentication-Results: verifier.port25.com; dkim=neutral (message not signed);
Authentication-Results: verifier.port25.com header.From=fobe@mydomain.com; pra=pass;

Why do I get "dkim=neutral" and not "pass" and why is it "not signed"? Is this normal? Can someone explain this...?
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 16 years ago in reply to PabloDiablo

Send me an email directly. The last one you sent didn't have a DKIM signature.

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 jgoslow over 16 years ago in reply to BAlfson

I'm getting the same error "dkim=temperror(d2i_PUBKEY_bio() failed)" for my settings...
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 16 years ago in reply to jgoslow

You did't repeat the entire error message line. fobe had a configuration problem that resulted in his emails not being DKIM signed.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel