Skip to content

[Possible bug?] Using Rspamd, outbound mails are not DKIM-signed #3621

@tchapi

Description

@tchapi

📝 Preliminary Checks

  • I tried searching for an existing issue and followed the debugging docs advice, but still need assistance.

👀 What Happened?

Outbound mails are not DKIM-signed, when using Rspamd.

I can receive mails without issue, and send mails, but providers that enforce DKIM (most of them) reject my mails, which is expected since the signature is indeed not there.

My SPF and DKIM records are all fine (tested with the relevant tools) FWIW.

Note
I'm not using IPv6, only IPv4

dkim_signing.conf:

enabled = true;

sign_authenticated = true;
sign_local = true;

use_domain = "header";
use_redis = false;   # don't change unless Redis also provides the DKIM keys
use_esld = true;
check_pubkey = true; # you want to use this in the beginning

domain {
    mydomain.me {
        path = "/tmp/docker-mailserver/rspamd/dkim/rsa-1024-20191108-mydomain.me.private.txt";
        selector = "20191108";
    }
}

In the container, the configuration files are present and in the right place:

root@mail:/tmp/docker-mailserver/rspamd# tree
.
|-- dkim
|   |-- rsa-1024-20191108-mydomain.me.private.txt
|   |-- rsa-1024-20191108-mydomain.me.public.dns.txt
|   `-- rsa-1024-20191108-mydomain.me.public.txt
`-- override.d
    `-- dkim_signing.conf

2 directories, 4 files
root@mail:/etc/rspamd# tree override.d
override.d
`-- dkim_signing.conf

0 directories, 1 file

I have followed the installation steps / configuration steps correctly (to the best of my knowledge), and have a pretty standard setup AFAIK.

I've searched for a while (Forums, Github issues here, the great Internet) but I can't see what I did wrong. I'm really sorry in advance if this is an obvious pebkac problem 🙇🏼 and I'll send you some 🍻 for the hassle if it is.

👟 Reproduction Steps

Tested with a few different email testers, they all report: No DKIM-Signature header found (https://mxtoolbox.com/, https://www.appmaildev.com/en/dkim/, etc)

No relevant logs in /var/log/rspamd:

root@mail:/var/log/rspamd# ls -la
total 8
drwxr-x--- 2 _rspamd _rspamd 4096 Mar 19  2023 .
drwxr-xr-x 1 root    root    4096 Nov  5 12:49 ..

The only interesting log I see is (see full trace below):

warning: connect to Milter service inet:localhost:11332: Cannot assign requested address

But looking at the FAQ, I only see answers for OpenDKIM and OpenDMARC, which I don't use.

And Rspamd seems to be running fine:

root@mail:/var/log/mail# ps axf
  PID TTY      STAT   TIME COMMAND
...
  599 ?        Sl     0:00  \_ redis-server 127.0.0.1:6379
  610 ?        S      0:00  \_ rspamd: main process
  766 ?        S      0:00  |   \_ rspamd: rspamd_proxy process (127.0.0.1:11332)
  767 ?        S      0:00  |   \_ rspamd: rspamd_proxy process (127.0.0.1:11332)
  768 ?        S      0:00  |   \_ rspamd: controller process (0.0.0.0:11334)
  769 ?        S      0:00  |   \_ rspamd: hs_helper process
...

I've also come across this log:

2023-11-04T22:45:03.755482327Z Nov  4 23:45:03 mail postfix/smtps/smtpd[828]: warning: hostname mail.mydomain.me does not resolve to address AA.BB.CC.DD
2023-11-04T22:45:03.755493565Z Nov  4 23:45:03 mail postfix/smtps/smtpd[828]: connect from unknown[AA.BB.CC.DD]

... where AA.BB.CC.DD is the public IP of the box, tied to mail.mydomain.me. But dig mail.mydomain.me in the container yields 172.100.0.4 which is the local address, and seems legit. I don't know if this could be a problem, though.

More info on the setup:

$ docker version
Client: Docker Engine - Community
 Version:           20.10.18
 API version:       1.41
 Go version:        go1.18.6
 Git commit:        b40c2f6
 Built:             Thu Sep  8 23:12:08 2022
 OS/Arch:           linux/amd64
 Context:           default
 Experimental:      true

Server: Docker Engine - Community
 Engine:
  Version:          20.10.18
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.18.6
  Git commit:       e42327a
  Built:            Thu Sep  8 23:09:59 2022
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.8
  GitCommit:        9cd3357b7fd7218e4aec3eae239db1f68a5a6ec6
 runc:
  Version:          1.1.4
  GitCommit:        v1.1.4-0-g5fd4c4d
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

No /etc/docker/daemon.json present.

I had a thorough look at this issue but it doesn't seem to be the same problem. Just in case:

root@mail:/# dig google.com +tcp

; <<>> DiG 9.16.37-Debian <<>> google.com +tcp
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38864
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;google.com.			IN	A

;; ANSWER SECTION:
google.com.		300	IN	A	142.250.201.174

;; Query time: 31 msec
;; SERVER: 127.0.0.11#53(127.0.0.11)
;; WHEN: Sun Nov 05 13:17:47 CET 2023
;; MSG SIZE  rcvd: 55

🐋 DMS Version

v12.1.0

💻 Operating System and Architecture

Debian 4.9.168-1+deb9u3 (2019-06-16) x86_64 GNU/Linux

⚙️ Container configuration files

mailserver:
    image: <custom image based on ghcr.io/docker-mailserver/docker-mailserver:12.1.0 with config files directly embedded>
    hostname: mail.mydomain.me
    ports:
      - "AA.BB.CC.DD:25:25" 
      - "AA.BB.CC.DD:143:143"
      - "AA.BB.CC.DD:465:465"
      - "AA.BB.CC.DD:587:587"
      - "AA.BB.CC.DD:993:993"
    volumes:
      - mails_data_volume:/var/mail
      - certificates:/etc/letsencrypt
      - mails_state_volume:/var/mail-state/
    environment:
      - LOG_LEVEL=debug
      - OVERRIDE_HOSTNAME=mail.mydomain.me
      - TZ=Europe/Paris
      - ENABLE_RSPAMD=1
      - ENABLE_OPENDKIM=0
      - ENABLE_OPENDMARC=0
      - ENABLE_POLICYD_SPF=0
      - ENABLE_AMAVIS=0
      - ENABLE_SPAMASSASSIN=0
      - ENABLE_CLAMAV=1
      - ENABLE_FAIL2BAN=1
      - SSL_TYPE=letsencrypt
      - SSL_DOMAIN=mail.mydomain.me
      - POSTFIX_MESSAGE_SIZE_LIMIT=20480000  # 20 MB
      - POSTMASTER_ADDRESS=postmaster@${TOP_DOMAIN}
    cap_add:
      - NET_ADMIN # For Fail2Ban to work
    healthcheck:
      test: "ss --listening --tcp | grep -P 'LISTEN.+:smtp' || exit 1"
      timeout: 30s
      retries: 0

📜 Relevant log output

2023-11-05T11:49:41.569280539Z [  DEBUG  ]  Handling general environment variable setup
2023-11-05T11:49:41.586963024Z [   INF   ]  Welcome to docker-mailserver 12.1.0
2023-11-05T11:49:41.589370841Z [  DEBUG  ]  Registering functions
2023-11-05T11:49:41.673585223Z [   INF   ]  Checking configuration
2023-11-05T11:49:41.676280321Z [  DEBUG  ]  Checking for improper restart
2023-11-05T11:49:41.678979189Z [  DEBUG  ]  Checking that hostname/domainname is provided or overridden
2023-11-05T11:49:41.681512280Z [  DEBUG  ]  Domain has been set to mydomain.me
2023-11-05T11:49:41.683997729Z [  DEBUG  ]  Hostname has been set to mail.mydomain.me
2023-11-05T11:49:41.710300117Z [   INF   ]  Configuring mail server
2023-11-05T11:49:41.712891081Z [  DEBUG  ]  Setting up general log files
2023-11-05T11:49:41.724469100Z [  DEBUG  ]  Setting timezone to 'Europe/Paris'
2023-11-05T11:49:42.041452655Z [  DEBUG  ]  Setting up Dovecot
2023-11-05T11:49:42.084478189Z [  DEBUG  ]  Setting up Dovecot dhparam
2023-11-05T11:49:42.087280215Z [  DEBUG  ]  Setting up Dovecot quota
2023-11-05T11:49:42.101109452Z [  DEBUG  ]  Setting up Dovecot Local User
2023-11-05T11:49:42.175249192Z [  DEBUG  ]  Creating user 'no-reply' for domain 'mydomain.me'
2023-11-05T11:49:42.211746963Z [  DEBUG  ]  Alias '[email protected]' is non-local (or mapped to a non-existing account) and will not be added to Dovecot's userdb
2023-11-05T11:49:42.228486740Z [  DEBUG  ]  Alias '[email protected]' is non-local (or mapped to a non-existing account) and will not be added to Dovecot's userdb
2023-11-05T11:49:42.244266597Z [  DEBUG  ]  Alias '[email protected]' is non-local (or mapped to a non-existing account) and will not be added to Dovecot's userdb
2023-11-05T11:49:42.259745912Z [  DEBUG  ]  Alias '[email protected]' is non-local (or mapped to a non-existing account) and will not be added to Dovecot's userdb
2023-11-05T11:49:42.263107735Z [  DEBUG  ]  Disabling OpenDKIM
2023-11-05T11:49:42.270498311Z [  DEBUG  ]  Disabling OpenDMARC
2023-11-05T11:49:42.270529771Z [  DEBUG  ]  Disabling policyd-spf
2023-11-05T11:49:42.275529773Z [  DEBUG  ]  Setting up Security Stack
2023-11-05T11:49:42.283428492Z [  DEBUG  ]  Postgrey is disabled
2023-11-05T11:49:42.283449707Z [  DEBUG  ]  Configuring Postscreen
2023-11-05T11:49:42.286793339Z [  DEBUG  ]  Disabling Postscreen DNSBLs
2023-11-05T11:49:42.335080786Z [  DEBUG  ]  SpamAssassin is disabled
2023-11-05T11:49:42.340850542Z [  DEBUG  ]  Enabling and configuring ClamAV
2023-11-05T11:49:42.358076088Z [  DEBUG  ]  Enabling and configuring Fail2Ban
2023-11-05T11:49:42.361746171Z [  DEBUG  ]  Disabling Amavis
2023-11-05T11:49:42.386273104Z [  DEBUG  ]  Spam emails will be moved to the Junk folder
2023-11-05T11:49:42.444550135Z [  DEBUG  ]  Enabling and configuring Rspamd
2023-11-05T11:49:42.454166222Z [  DEBUG  ]  (Rspamd setup) Found directory '/tmp/docker-mailserver/rspamd/override.d/' - linking it to '/etc/rspamd/override.d'
2023-11-05T11:49:42.467372951Z [  DEBUG  ]  (Rspamd setup) Internal Redis is enabled, adding configuration
2023-11-05T11:49:42.516864726Z [  DEBUG  ]  (Rspamd setup) Adjusting Postfix's configuration
2023-11-05T11:49:42.563066825Z [  DEBUG  ]  (Rspamd setup) Enabling ClamAV integration
2023-11-05T11:49:42.678449669Z [  DEBUG  ]  (Rspamd setup) Disabling default modules
2023-11-05T11:49:42.721561072Z [  DEBUG  ]  (Rspamd setup) Intelligent learning of spam and ham is disabled
2023-11-05T11:49:42.724973126Z [  DEBUG  ]  (Rspamd setup) Greylisting is disabled
2023-11-05T11:49:42.728302758Z [  DEBUG  ]  (Rspamd setup) Hfilter (group) module is enabled
2023-11-05T11:49:42.736764681Z [  DEBUG  ]  Setting up SSL
2023-11-05T11:49:42.753543465Z [  DEBUG  ]  TLS configured with 'modern' ciphers
2023-11-05T11:49:42.755413389Z [  DEBUG  ]  Configuring SSL using 'letsencrypt'
2023-11-05T11:49:42.947058401Z [  DEBUG  ]  Setting up PERMIT_DOCKER option
2023-11-05T11:49:42.995962920Z [  DEBUG  ]  Setting up mailname and creating '/etc/mailname'
2023-11-05T11:49:42.998051305Z [  DEBUG  ]  Applying hostname to Dovecot
2023-11-05T11:49:43.004766918Z [  DEBUG  ]  Configuring Postfix (early setup)
2023-11-05T11:49:43.200488054Z [  DEBUG  ]  Setting up Postfix dhparam
2023-11-05T11:49:43.249249167Z [  DEBUG  ]  Fetchmail is disabled
2023-11-05T11:49:43.254508399Z [  DEBUG  ]  Fetchmail parallel is disabled
2023-11-05T11:49:43.258804062Z [  DEBUG  ]  Spoof protection is disabled
2023-11-05T11:49:43.280712336Z [  DEBUG  ]  Configuring Postfix (late setup)
2023-11-05T11:49:43.287868620Z [  DEBUG  ]  Setting up Postfix Relay Hosts
2023-11-05T11:49:43.290814864Z [  DEBUG  ]  (Postfix setup) Overriding / adjusting configuration with user-supplied values
2023-11-05T11:49:43.338819436Z [  DEBUG  ]  Setting up logrotate
2023-11-05T11:49:43.343976970Z [  DEBUG  ]  Postfix log summary reports disabled
2023-11-05T11:49:43.348619823Z [  DEBUG  ]  Logwatch reports disabled.
2023-11-05T11:49:43.351360789Z [  DEBUG  ]  Consolidating all state onto /var/mail-state
2023-11-05T11:49:43.494452269Z [  DEBUG  ]  Checking /var/mail permissions
2023-11-05T11:49:43.502775266Z [  DEBUG  ]  Removing files and directories from older versions
2023-11-05T11:49:43.508692903Z [  DEBUG  ]  Exporting environment variables now (creating '/etc/dms-settings')
2023-11-05T11:49:43.525463065Z [  DEBUG  ]  Setting up configuration checksum file
2023-11-05T11:49:43.567986613Z [  DEBUG  ]  Printing environment variables. Make sure no sensitive data is copied.
2023-11-05T11:49:43.570439670Z ACCOUNT_PROVISIONER='FILE'
2023-11-05T11:49:43.570505730Z AMAVIS_LOGLEVEL='0'
2023-11-05T11:49:43.570522785Z CLAMAV_MESSAGE_SIZE_LIMIT='25M'
2023-11-05T11:49:43.570536348Z DEFAULT_RELAY_HOST=''
2023-11-05T11:49:43.570547534Z DOVECOT_INET_PROTOCOLS='all'
2023-11-05T11:49:43.570556635Z DOVECOT_MAILBOX_FORMAT='maildir'
2023-11-05T11:49:43.570565308Z DOVECOT_TLS='no'
2023-11-05T11:49:43.570573708Z ENABLE_AMAVIS='0'
2023-11-05T11:49:43.570581844Z ENABLE_CLAMAV='1'
2023-11-05T11:49:43.570589969Z ENABLE_DNSBL='0'
2023-11-05T11:49:43.570598176Z ENABLE_FAIL2BAN='1'
2023-11-05T11:49:43.570606245Z ENABLE_FETCHMAIL='0'
2023-11-05T11:49:43.570614371Z ENABLE_MANAGESIEVE='0'
2023-11-05T11:49:43.570622723Z ENABLE_OPENDKIM='0'
2023-11-05T11:49:43.570630865Z ENABLE_OPENDMARC='0'
2023-11-05T11:49:43.570639021Z ENABLE_POLICYD_SPF='0'
2023-11-05T11:49:43.570647197Z ENABLE_POP3='0'
2023-11-05T11:49:43.570655432Z ENABLE_POSTGREY='0'
2023-11-05T11:49:43.570663790Z ENABLE_QUOTAS='1'
2023-11-05T11:49:43.570671879Z ENABLE_RSPAMD='1'
2023-11-05T11:49:43.570680057Z ENABLE_RSPAMD_REDIS='1'
2023-11-05T11:49:43.570688340Z ENABLE_SASLAUTHD='0'
2023-11-05T11:49:43.570696587Z ENABLE_SPAMASSASSIN='0'
2023-11-05T11:49:43.570704676Z ENABLE_SPAMASSASSIN_KAM='0'
2023-11-05T11:49:43.570712874Z ENABLE_SRS='0'
2023-11-05T11:49:43.570720965Z ENABLE_UPDATE_CHECK='1'
2023-11-05T11:49:43.570729143Z FAIL2BAN_BLOCKTYPE='drop'
2023-11-05T11:49:43.570737214Z FETCHMAIL_PARALLEL='0'
2023-11-05T11:49:43.570745313Z FETCHMAIL_POLL='300'
2023-11-05T11:49:43.570753581Z LOGROTATE_INTERVAL='weekly'
2023-11-05T11:49:43.570761745Z LOGWATCH_INTERVAL='none'
2023-11-05T11:49:43.570770015Z LOGWATCH_RECIPIENT='[email protected]'
2023-11-05T11:49:43.570778484Z LOGWATCH_SENDER='[email protected]'
2023-11-05T11:49:43.570786840Z LOG_LEVEL='debug'
2023-11-05T11:49:43.570795003Z MOVE_SPAM_TO_JUNK='1'
2023-11-05T11:49:43.570803132Z NETWORK_INTERFACE='eth0'
2023-11-05T11:49:43.570811297Z ONE_DIR='1'
2023-11-05T11:49:43.570819545Z OVERRIDE_HOSTNAME='mail.mydomain.me'
2023-11-05T11:49:43.570827891Z PERMIT_DOCKER='none'
2023-11-05T11:49:43.570836039Z PFLOGSUMM_RECIPIENT='[email protected]'
2023-11-05T11:49:43.570844343Z PFLOGSUMM_SENDER='[email protected]'
2023-11-05T11:49:43.570852657Z PFLOGSUMM_TRIGGER='none'
2023-11-05T11:49:43.570861008Z POSTFIX_DAGENT=''
2023-11-05T11:49:43.570869047Z POSTFIX_INET_PROTOCOLS='all'
2023-11-05T11:49:43.570877381Z POSTFIX_MAILBOX_SIZE_LIMIT='0'
2023-11-05T11:49:43.570893117Z POSTFIX_MESSAGE_SIZE_LIMIT='20480000'
2023-11-05T11:49:43.570901579Z POSTFIX_REJECT_UNKNOWN_CLIENT_HOSTNAME='0'
2023-11-05T11:49:43.570909973Z POSTGREY_AUTO_WHITELIST_CLIENTS='5'
2023-11-05T11:49:43.570918267Z POSTGREY_DELAY='300'
2023-11-05T11:49:43.570926358Z POSTGREY_MAX_AGE='35'
2023-11-05T11:49:43.570934590Z POSTGREY_TEXT='Delayed by Postgrey'
2023-11-05T11:49:43.570942890Z POSTMASTER_ADDRESS='[email protected]'
2023-11-05T11:49:43.570951289Z POSTSCREEN_ACTION='enforce'
2023-11-05T11:49:43.570959580Z RELAY_HOST=''
2023-11-05T11:49:43.570967763Z REPORT_RECIPIENT='[email protected]'
2023-11-05T11:49:43.570976031Z REPORT_SENDER='[email protected]'
2023-11-05T11:49:43.570984406Z RSPAMD_GREYLISTING='0'
2023-11-05T11:49:43.570992481Z RSPAMD_HFILTER='1'
2023-11-05T11:49:43.571000661Z RSPAMD_HFILTER_HOSTNAME_UNKNOWN_SCORE='6'
2023-11-05T11:49:43.571008944Z RSPAMD_LEARN='0'
2023-11-05T11:49:43.571016987Z SA_KILL='10.0'
2023-11-05T11:49:43.571025187Z SA_SPAM_SUBJECT='***SPAM*** '
2023-11-05T11:49:43.571033398Z SA_TAG2='6.31'
2023-11-05T11:49:43.571041416Z SA_TAG='2.0'
2023-11-05T11:49:43.571049606Z SMTP_ONLY='0'
2023-11-05T11:49:43.571057658Z SPAMASSASSIN_SPAM_TO_INBOX='1'
2023-11-05T11:49:43.571065894Z SPOOF_PROTECTION='0'
2023-11-05T11:49:43.571079630Z SRS_DOMAINNAME='mydomain.me'
2023-11-05T11:49:43.571088035Z SRS_EXCLUDE_DOMAINS=''
2023-11-05T11:49:43.571099132Z SRS_SECRET=''
2023-11-05T11:49:43.571107294Z SRS_SENDER_CLASSES='envelope_sender'
2023-11-05T11:49:43.571115606Z SSL_TYPE='letsencrypt'
2023-11-05T11:49:43.571123685Z SUPERVISOR_LOGLEVEL='warn'
2023-11-05T11:49:43.571131843Z TLS_LEVEL='modern'
2023-11-05T11:49:43.571139922Z TZ='Europe/Paris'
2023-11-05T11:49:43.571148061Z UPDATE_CHECK_INTERVAL='1d'
2023-11-05T11:49:43.571156364Z VIRUSMAILS_DELETE_DELAY='7'
2023-11-05T11:49:43.574676643Z [  DEBUG  ]  Applying user patches
2023-11-05T11:49:43.579179007Z user-patches.sh: Discarding all mails for no-reply address
2023-11-05T11:49:43.579402518Z user-patches.sh: Creating the postmap for the transport file
2023-11-05T11:49:43.617540306Z user-patches.sh: Successfully executed
2023-11-05T11:49:43.621135245Z [   INF   ]  Starting daemons
2023-11-05T11:49:43.623930571Z [  DEBUG  ]  Starting cron
2023-11-05T11:49:43.860842201Z [  DEBUG  ]  Starting rsyslog
2023-11-05T11:49:44.072811069Z [  DEBUG  ]  Starting dovecot
2023-11-05T11:49:44.274277862Z [  DEBUG  ]  Starting update-check
2023-11-05T11:49:44.485723711Z [  DEBUG  ]  Starting rspamd-redis
2023-11-05T11:49:44.723818691Z [  DEBUG  ]  Starting rspamd
2023-11-05T11:49:44.941110092Z [  DEBUG  ]  Starting postfix
2023-11-05T11:49:45.219511573Z [  DEBUG  ]  Starting fail2ban
2023-11-05T11:49:45.477070393Z [  DEBUG  ]  Starting clamav
2023-11-05T11:49:45.798534379Z [  DEBUG  ]  Starting changedetector
2023-11-05T11:49:46.048355003Z [   INF   ]  mail.mydomain.me is up and running
2023-11-05T11:49:47.051822482Z Nov  5 12:49:46 mail postfix/postscreen[761]: CONNECT from [216.144.232.240]:1360 to [172.100.0.4]:25
2023-11-05T11:49:47.051869963Z Nov  5 12:49:46 mail postfix/postscreen[761]: PASS OLD [216.144.232.240]:1360
2023-11-05T11:49:47.051876077Z Nov  5 12:49:46 mail postfix/smtpd[762]: warning: hostname 216.144.232.240.static.quadranet.com does not resolve to address 216.144.232.240
2023-11-05T11:49:47.051881084Z Nov  5 12:49:46 mail postfix/smtpd[762]: connect from unknown[216.144.232.240]
2023-11-05T11:49:47.051885705Z Nov  5 12:49:46 mail postfix/smtpd[762]: warning: connect to Milter service inet:localhost:11332: Cannot assign requested address
2023-11-05T11:49:47.051890409Z Nov  5 12:49:46 mail postfix/smtpd[762]: lost connection after AUTH from unknown[216.144.232.240]
2023-11-05T11:49:47.051894887Z Nov  5 12:49:46 mail postfix/smtpd[762]: disconnect from unknown[216.144.232.240] ehlo=1 auth=0/1 commands=1/2

Improvements to this form?

No response

Metadata

Metadata

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions