I have tried to show a step-by-step guide for implementing Yahoo! DomainKeys on your Debian Linux Server. If you have any other server and want us to accomplish the tasks for you, feel free to contact us

You are free to publish this document else where, provided you point a link to our website www.enterux.com and Mentioning us as the Original Author for this document.

So here we start, I assume that you have root previledges on your Debian Box.

You need to determine which MTA (Mail Transfer Agent) you are using, by default Debian comes with Exim, but since our howto deals with doing this using Postfix, we would install Postfix first.

WARNING! : The Above command shall remove your current MTA - which would be exim, so make sure you backup your stuff.

Next we need to install the following Perl Modules from CPAN archive.

• Crypt::OpenSSL::RSA
• Mail::Address
• MIME::Base64
• Net::DNS
• Test::More
• Text::Wrap
• Mail::DomainKeys

• Crypt::OpenSSL::RSA
• Mail::Address
• MIME::Base64
• Net::DNS
• Test::More
• Text::Wrap
• Mail::DomainKeys

Following commands would help.
Note: The first time you install the module, Perl shall ask you to choose the nearest mirror of CPAN archive, just press enter key if you dont understand anything and it should be done all right.

tar zxf commands-0.2.tar.gz
tar zxf dkfilter.tgz

Next we need to compile dkfilter package.

cd /var/domainkeys/dkfilter-0.8
./configure --prefix=/usr/local/dkfilter
make install
useradd dkfilter
groupadd dkfilter
cp ../dkfilter /etc/init.d/dkfilter
chmod 755 /etc/init.d/dkfilter

We need to make relevant changes inside Postfix configuration files to check incoming mails for the signature

#
# Before-filter SMTP server. Receive mail from the network and
# pass it to the content filter on localhost port 10025.
#
smtp inet n - n - - smtpd
-o smtpd_proxy_filter=127.0.0.1:10025
-o smtpd_client_connection_count_limit=10
#
# After-filter SMTP server. Receive mail from the content filter on
# localhost port 10026.
#
127.0.0.1:10026 inet n - n - - smtpd
-o smtpd_authorized_xforward_hosts=127.0.0.0/8
-o smtpd_client_restrictions=
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o smtpd_data_restrictions=
-o mynetworks=127.0.0.0/8
-o receive_override_options=no_unknown_recipient_checks
===========================================================

Now to configure Outgoing mails which needs to signed by your private keys i.e. Setting up the Outbound Filter.

cd /var/domainkeys/bin
./dk_generate_policy -a -d enterux.com -n http://www.enterux.com/en/resources/yahoo-domainkeys-howto-debian -q -r support@enterux.com -t
./dk_generate_selector -d enterux.com -n http://www.enterux.com/en/resources/yahoo-domainkeys-howto-debian -k 768 -q -s postfix -S
cp postfix.enterux.com.public.pem /usr/local/dkfilter/public.key
cp postfix.enterux.com.private.pem /usr/local/dkfilter/private.pem

You need to replace your domain name on the argument -d enterux.com, e.g -d yourdomainname.com

By default Debian runs Bind DNS Server, so the next step would be to edit yourdomainname.com Zone file.

Change the SOA, Serial number so that secondary DNS Servers know about the change.

Now we need to tell Postfix to sign all outbound mails.

#
# modify the default submission service to specify a content filter
# and restrict it to local clients and SASL authenticated clients only
#
submission inet n - n - - smtpd
-o smtpd_etrn_restrictions=reject
-o smtpd_sasl_auth_enable=yes
-o content_filter=dksign:127.0.0.1:10027
-o receive_override_options=no_address_mappings
-o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject

#
# specify the location of the DomainKeys signing filter
#
dksign unix - - n - 10 smtp
-o smtp_send_xforward_command=yes

#
# service for accepting messages FROM the DomainKeys signing filter
#
127.0.0.1:10028 inet n - n - 10 smtpd
-o content_filter=
-o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
-o smtpd_helo_restrictions=
-o smtpd_client_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o mynetworks=127.0.0.0/8
-o smtpd_authorized_xforward_hosts=127.0.0.0/8

# For Postfix to sign mails sent out using Webmails
pickup fifo n - n 60 1 pickup
-o content_filter=dksign:127.0.0.1:10027

save and restart Postfix as well as DNS Server.

/etc/init.d/bind9 restart
/etc/init.d/postfix restart
/etc/init.d/dkfilter start

You are up and running now with DKFilter signing all the outgoing mails and would check all incoming mails for DomainKey signatures.

For more details on the DKFilter setup, please refer to Jason Longs DKFilter Page

If you find any problem with the above, feel free to email me.

Feel free to donate an amount you feel is worthy ($5, $10 or more, it's up to you!) through a free PayPal account, you can use your credit card, or transfer money from a bank account with your PayPal account. Please click on the Paypal icon below