Discussion:
[dkim-milter-discuss] DKIM check: temperror
Fabrizio Regalli
2010-11-30 21:18:27 UTC
Permalink
Hello.

I' ve installed DKIM on debian lenny.
Installation and configuration goes fine but each test fails.

This is last result from port25.com:


SPF check: pass
DomainKeys check: neutral
DKIM check: temperror
Sender-ID check: pass
SpamAssassin check: ham

As you can see it tells "neutral" and "temperror" but I don't understand
why.
If I try with "dig" command the result is like excepted:

:$ host -t txt mail._domainkey.mailsicura.org.
mail._domainkey.mailsicura.org descriptive text "v=DKIM1\; g=*\; k=rsa\;
t=y\; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDByWhTDW2ylR
+twT5v6gXeK4GTkeKHycYapUxvdV2QL83IoYFUixEZ30fyLKkpkrfvHoJyQDAefy58b2VtJbWDZLXLn3wNDxRLx6LAX5a2Lyc/eMGnkd3QEpqIf+wrsPePkDW45RncuxjUMI6wgMUh3seyW5NIYOJC+GjoEfsKewIDAQAB"

My /etc/dkim-filter.conf looks like

Syslog yes
LogWhy yes
UMask 002
AutoRestart yes
AutoRestartRate 10/1h
Background yes
Canonicalization simple
DNSTimeout 5
Mode sv
SignatureAlgorithm rsa-sha256
SubDomains no
#ADSPDiscard no
#Version rfc4871
X-Header no
KeyList /etc/dkim-keys.conf

and my /etc/dkim-keys.conf looks like

*@mailsicura.org:mailsicura.org:/etc/dkim/keys/mailsicura.org/mail.

and in /etc/dkim/keys/mailsicura.org/mail. there is the private key.
The folder permissions seems to be ok (dkim-filter:dkim-filter)


Could someone please give me a suggest on what I missed?

Thanks.
Regards.

Fabrizio
Fabrizio Regalli
2010-11-30 22:00:21 UTC
Permalink
Post by Fabrizio Regalli
Hello.
I' ve installed DKIM on debian lenny.
Installation and configuration goes fine but each test fails.
SPF check: pass
DomainKeys check: neutral
DKIM check: temperror
Sender-ID check: pass
SpamAssassin check: ham
As you can see it tells "neutral" and "temperror" but I don't understand
why.
:$ host -t txt mail._domainkey.mailsicura.org.
mail._domainkey.mailsicura.org descriptive text "v=DKIM1\; g=*\; k=rsa\;
t=y\; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDByWhTDW2ylR
+twT5v6gXeK4GTkeKHycYapUxvdV2QL83IoYFUixEZ30fyLKkpkrfvHoJyQDAefy58b2VtJbWDZLXLn3wNDxRLx6LAX5a2Lyc/eMGnkd3QEpqIf+wrsPePkDW45RncuxjUMI6wgMUh3seyW5NIYOJC+GjoEfsKewIDAQAB"
My /etc/dkim-filter.conf looks like
Syslog yes
LogWhy yes
UMask 002
AutoRestart yes
AutoRestartRate 10/1h
Background yes
Canonicalization simple
DNSTimeout 5
Mode sv
SignatureAlgorithm rsa-sha256
SubDomains no
#ADSPDiscard no
#Version rfc4871
X-Header no
KeyList /etc/dkim-keys.conf
and my /etc/dkim-keys.conf looks like
and in /etc/dkim/keys/mailsicura.org/mail. there is the private key.
The folder permissions seems to be ok (dkim-filter:dkim-filter)
Could someone please give me a suggest on what I missed?
Thanks.
Regards.
Fabrizio
Hi again,

I changed "Canonicalization" values from simple to relaxed/relaxed but
unfortunately nothing changed.
Gmail says:

...
Authentication-Results: mx.google.com; spf=pass (google.com: domain of
***@mailsicura.org designates 89.96.231.236 as permitted sender)
smtp.mail=***@mailsicura.org; dkim=neutral (bad format)
header.i=@mailsicura.org

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mailsicura.org;
s=mail.; t=1291154324; bh=fo1KM/9iLg4HeVoSh0vyLLUwihXR50d/OPwyIALa+dU=;
h=Subject:From:To:Content-Type:Date:Message-ID:Mime-Version;
b=oZ7dQG3tfa1wQvK4d6PFGYenq+8JUxO1gl1i4Xq
+YQpfhlMOoV04p5LVpPIQI3NgM /1UH06Nx53pkFJS9kMpydUjgse4
+99qmBPMtXEPLlZjGI7SEl03UKh8WS/Ufy5Wj5v tgaYg9O5nekLNV/2eXpDnEOoPbyadh9l
+/Jf+w3I=


and yahoo:

Authentication-Results: mta1142.mail.sk1.yahoo.com from=mailsicura.org;
domainkeys=neutral (no sig); from=mailsicura.org; dkim=temperror (key
retrieval failed)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mailsicura.org;
s=mail.; t=1291154324; bh=fo1KM/9iLg4HeVoSh0vyLLUwihXR50d/OPwyIALa+dU=;
h=Subject:From:To:Content-Type:Date:Message-ID:Mime-Version;
b=oZ7dQG3tfa1wQvK4d6PFGYenq+8JUxO1gl1i4Xq
+YQpfhlMOoV04p5LVpPIQI3NgM /1UH06Nx53pkFJS9kMpydUjgse4
+99qmBPMtXEPLlZjGI7SEl03UKh8WS/Ufy5Wj5v tgaYg9O5nekLNV/2eXpDnEOoPbyadh9l
+/Jf+w3I=

Thanks again.
Mark Martinec
2010-11-30 22:43:27 UTC
Permalink
Post by Fabrizio Regalli
Post by Fabrizio Regalli
DKIM check: temperror
As you can see it tells "neutral" and "temperror" but I don't understand
why.
:$ host -t txt mail._domainkey.mailsicura.org.
Authentication-Results: mta1142.mail.sk1.yahoo.com from=mailsicura.org;
domainkeys=neutral (no sig); from=mailsicura.org; dkim=temperror (key
retrieval failed)
$ host -C mailsicura.org
mailsicura.org NS dns.mailsicura.org
dns.mailsicura.org fab.mailsicura.org (2010113009 10800 1800 604800 3600)
mailsicura.org NS ns6.gandi.net
mailsicura.org SOA record not found at ns6.gandi.net, server failure
mailsicura.org has lame delegation to ns6.gandi.net

Mark
Rolf E. Sonneveld
2010-11-30 22:20:21 UTC
Permalink
Post by Fabrizio Regalli
Post by Fabrizio Regalli
Hello.
I' ve installed DKIM on debian lenny.
Installation and configuration goes fine but each test fails.
SPF check: pass
DomainKeys check: neutral
DKIM check: temperror
Sender-ID check: pass
SpamAssassin check: ham
As you can see it tells "neutral" and "temperror" but I don't understand
why.
:$ host -t txt mail._domainkey.mailsicura.org.
mail._domainkey.mailsicura.org descriptive text "v=DKIM1\; g=*\; k=rsa\;
t=y\; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDByWhTDW2ylR
+twT5v6gXeK4GTkeKHycYapUxvdV2QL83IoYFUixEZ30fyLKkpkrfvHoJyQDAefy58b2VtJbWDZLXLn3wNDxRLx6LAX5a2Lyc/eMGnkd3QEpqIf+wrsPePkDW45RncuxjUMI6wgMUh3seyW5NIYOJC+GjoEfsKewIDAQAB"
My /etc/dkim-filter.conf looks like
Syslog yes
LogWhy yes
UMask 002
AutoRestart yes
AutoRestartRate 10/1h
Background yes
Canonicalization simple
DNSTimeout 5
Mode sv
SignatureAlgorithm rsa-sha256
SubDomains no
#ADSPDiscard no
#Version rfc4871
X-Header no
KeyList /etc/dkim-keys.conf
and my /etc/dkim-keys.conf looks like
and in /etc/dkim/keys/mailsicura.org/mail. there is the private key.
The folder permissions seems to be ok (dkim-filter:dkim-filter)
Could someone please give me a suggest on what I missed?
Thanks.
Regards.
Fabrizio
Hi again,
I changed "Canonicalization" values from simple to relaxed/relaxed but
unfortunately nothing changed.
...
Authentication-Results: mx.google.com; spf=pass (google.com: domain of
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mailsicura.org;
s=mail.; t=1291154324; bh=fo1KM/9iLg4HeVoSh0vyLLUwihXR50d/OPwyIALa+dU=;
h=Subject:From:To:Content-Type:Date:Message-ID:Mime-Version;
b=oZ7dQG3tfa1wQvK4d6PFGYenq+8JUxO1gl1i4Xq
+YQpfhlMOoV04p5LVpPIQI3NgM /1UH06Nx53pkFJS9kMpydUjgse4
+99qmBPMtXEPLlZjGI7SEl03UKh8WS/Ufy5Wj5v tgaYg9O5nekLNV/2eXpDnEOoPbyadh9l
+/Jf+w3I=
Authentication-Results: mta1142.mail.sk1.yahoo.com from=mailsicura.org;
domainkeys=neutral (no sig); from=mailsicura.org; dkim=temperror (key
retrieval failed)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mailsicura.org;
s=mail.; t=1291154324; bh=fo1KM/9iLg4HeVoSh0vyLLUwihXR50d/OPwyIALa+dU=;
h=Subject:From:To:Content-Type:Date:Message-ID:Mime-Version;
b=oZ7dQG3tfa1wQvK4d6PFGYenq+8JUxO1gl1i4Xq
+YQpfhlMOoV04p5LVpPIQI3NgM /1UH06Nx53pkFJS9kMpydUjgse4
+99qmBPMtXEPLlZjGI7SEl03UKh8WS/Ufy5Wj5v tgaYg9O5nekLNV/2eXpDnEOoPbyadh9l
+/Jf+w3I=
I assume the problem is in the dot within your selector. Using a dot in
the selector creates a double-dot in the DNS location where the key has
to be stored/retrieved (mail.._domainkey.mailsicura.org is not a valid
DNS name).

/rolf
Fabrizio Regalli
2010-11-30 22:49:28 UTC
Permalink
Post by Rolf E. Sonneveld
I assume the problem is in the dot within your selector. Using a dot in
the selector creates a double-dot in the DNS location where the key has
to be stored/retrieved (mail.._domainkey.mailsicura.org is not a valid
DNS name).
/rolf
Thanks Rolf, you are right!
The problem is the final dot: I delete it and rename my private key
without final dot and works great!
Sorry for my stupid mistake!

Regards,
Fabrizio

Loading...