DKIM - Virtual Domain Signing

[soapee01]

Hi,

Proxmox is installed somewhere like pmg.example.com
DKIM for this domain is working. It correctly signs an email for mail from this domain (example.com) with a header like:

header.i=@example.com header.s=dkim-pmg

I've added a virtual domain to relay on behalf of, and it changes the header.i to the new domain (foobar.com). I suppose I could publish the DNS DKIM entry on that domain as well, but I'd rather not have to, because of laziness/error potential. I get DKIM failures due to this. It sends info like the following, but I want the header to use example.com instead of this:

header.i=@foobar.com header.s=dkim-pmg

Obviously when header.i is set to foobar, DKIM will fail without a corresponding DNS entry for that domain.

I've tried various combinations of settings on Configuration -> Mail Proxy -> DKIM:

sign domains has no entries, and "Sign all outgoing mail" is selected,
sign domains has the entry foobar.com and "Sign all outgoing mail" is selected
sign domains has the entry foobar.com and "Sign all outgoing mail" is UNselected.

Any advice on this one?

Thanks!

 

[Stoiko Ivanov]

PMG uses the sending email address (from the envelop sender) to determine if a mail should be signed.
so for now you need to publish the DNS records
(I also don't think we will change that - usually you want the signature to have some link to the domain where the mail is sent from)

I hope this explains it!

 

[soapee01]

Thank you for your answer. An option would be better. I'm not aware of how dkim signing by the sending domain has any affect on delivery. All of the major players sign themselves (Microsoft, Google, hushmail) so it makes it a pain if you plan on hosting for customers to edit so many DNS entries in the event of a cert regeneration or security issue.

Perhaps it could be an enterprise feature?

 

[Stoiko Ivanov]

Perhaps it could be an enterprise feature?

All Proxmox products contain all features - there are no features which are only available on the enterprise repository

you can add the request to https://bugzilla.proxmox.com/show_bug.cgi?id=2971
once we get around to implementing that we can see if it makes sense to take it in

I hope this helps!