qmail-1.03 & Netqmail-1.06 / DomainKeys Integration Howto v20081001.02

Some documentation stolen from the qmail-dk patch itself
This document assumes example.com is the domain in the From: field that you'll be dk_signing for.
Text in bold are unique to each installation. (although you can choose to keep the keyword 'default').

1. install qmail as per www.lifewithqmail.org (skip this if you have an existing/compatible qmail installation).
    any qmail install based off LWQ should be compatible - including netqmail, qmail-isp, and even qmail-aio.

2. install OpenSSL as per the INSTALL file of the latest stable tarball (skip if you already have an existing/compatible OpenSSL)

3. Set it all up
  cd /usr/local/src/
  wget http://cr.yp.to/software/qmail-1.03.tar.gz
  wget http://superb-east.dl.sourceforge.net/sourceforge/domainkeys/libdomainkeys-0.68.tar.gz
  wget http://www.qmail.org/qmail-1.03-dk-0.54.patch
  wget http://jeremy.kister.net/code/qmail-dk-0.54-auth.patch # optional, for smtp-auth
  tar -zxvf libdomainkeys-0.68.tar.gz
  cd libdomainkeys-0.68
  tar -zxvf /usr/local/src/qmail-1.03.tar.gz
  echo 'gcc -O2 -include /usr/include/errno.h' > qmail-1.03/conf-cc
  patch -d qmail-1.03/ < ../qmail-1.03-dk-0.54.patch
  patch -d qmail-1.03/ < ../qmail-dk-0.54-auth.patch   # optional, for smtp-auth
  cd qmail-1.03
  make qmail-dk
  cp qmail-dk /var/qmail/bin/
  cp qmail-dk.8 /var/qmail/man/man8/
  chown qmailq /var/qmail/bin/qmail-dk
  chmod 4711 /var/qmail/bin/qmail-dk
4. Next, we set up a RSA key pair, as according to http://domainkeys.sourceforge.net/keygen.html.
  mkdir -p /etc/domainkeys/example.com/
  cd /etc/domainkeys/example.com/
  /usr/local/ssl/bin/openssl genrsa -out rsa.private 768
  /usr/local/ssl/bin/openssl rsa -in rsa.private -out rsa.public -pubout -outform PEM
  mv rsa.private default
  chown -R qmailq /etc/domainkeys
  chmod 0600 default
5. Make your public DomainKey:
  grep -v ^- rsa.public | perl -e 'while(<>){chop;$l.=$_;}print "k=rsa; t=y; p=$l;\n";'
6. Create a TXT record in your DNS as per http://domainkeys.sourceforge.net/dist.html:
For tinydns (djbdns):
'_domainkey.example.com.:k=rsa; t=y; o=-;

or for BIND:
_domainkey.example.com. IN TXT "k=rsa; t=y; o=-;"
default._domainkey.example.com. IN TXT "DomainKey_from_step_5"
7. Next, modify your /etc/tcp.smtp:
  • If you control who relays through your machine via RELAYCLIENT:


  • Or, if you use SMTP AUTH to control who relays through your machine,
        and you've patched with the above qmail-0.54-dk-auth.patch,
        you don't have to worry about setting DKSIGN:

  • :allow,DKVERIFY="DEGIJKfh",QMAILQUEUE="bin/qmail-dk"

    8. Rebuild your cdb file:
      qmailctl cdb
    9. Be sure to watch your /var/log/qmail/smtpd/current for problems involving
    not having enough memory. You may need to increase the softlimit memory
    size in /service/qmail-smtpd/run.

    10. If you want qmail-dk to sign messages that you send from the command line,
    you have to set up some environment variables.

    You can choose to modify your .profile:

    Or, as Kyle Wheeler suggested, you can put a wrapper around sendmail:
    export QMAILQUEUE=/var/qmail/bin/qmail-dk
    export DKSIGN=/etc/domainkeys/example.com/default
    exec /var/qmail/bin/sendmail "$@"

    11. And finally, test your installation:
    send mail to dktest@temporary.com. You should get a reply within a few minutes.

    When you're satisfied with your installation:
    change the "t=y" in your DNS TXT RRs to "t=n": this takes your DomainKey out of "test mode".
    To be a bit more aggressive, add a "B" to your DKVERIFY string. man qmail-dk for more info.

    Portability Notes

    On Solaris 2.7 and 2.9, before the make in libdomainkeys-0.68, I had to:
  • use GNU patch

  • in the libdomainkeys-0.68/Makefile:

  • INCS=-I. -I/usr/local/ssl/include
    LIBS=-L. -L/usr/local/ssl/lib -ldomainkeys -lcrypto

    And then, before the make qmail-dk in qmail-1.03, I had to:
  • echo 'gcc -O2 -I/usr/local/ssl/include' > conf-cc

  • echo 'gcc -s -L/usr/local/ssl/lib' > conf-ld

  • export LD_RUN_PATH=/usr/local/ssl/lib:$LD_RUN_PATH

  • On FreeBSD 5.2.1-R, before the make in libdomainkeys-0.68, I had to:
  • in the libdomainkeys-0.68/Makefile, comment out lines 8-15 (UNAME := ... endif)

  • On Slackware, it is reported that you have to:
  • in the Makefile:

  • LIBS=-L. -ldomainkeys -lcrypto -lresolv

    On Gentoo, it is reported that you have to:
  • During step 3:

  • tar -zxvf libdomainkeys-0.68.tar.gz
    cd libdomainkeys-0.68
    echo '-lresolv' > dns.lib

    Jeremy Kister