docs: Rspamd DKIM config simplify via `path` setting by denisix · Pull Request #3702 · docker-mailserver/docker-mailserver · GitHub

using DKIM signing in Rspamd - automatically match keys for domains in dkim_signing.conf

Description

in dkim_signing.conf added configuration lines to automatically match domain keys instead of manually adding config for each domain that configured in DMS

Type of change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Improvement (non-breaking change that does improve existing functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
This change requires a documentation update

Checklist:

My code follows the style guidelines of this project
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation (README.md or the documentation under docs/)
If necessary I have added tests that prove my fix is effective or that my feature works
New and existing unit tests pass locally with my changes
I have added information about changes made in this PR to CHANGELOG.md

using DKIM signing in Rspamd - automatically match keys for domains in dkim_signing.conf

Nice improvement thanks!

Can you please cite the source for this feature? (EDIT: Not necessary, cited below)

I see on the rspamd dkim docs that selector is used as the default with the $selector variable, but $domain is only mentioned in a comment, is that also a fixed fallback value or is it documented somewhere as dynamic?

EDIT: After reading the first section and going over the config example / defaults, I see that $domain is from use_domain setting, which defaults to dynamically sourced from header but could be configured as a fixed domain. While selector defaults to dkim.

This context with source citing is now also part of the related TODO issue: #3778

Alternatively there is a simple selector_map setting that references a file of $domain $selector pairs per line.

The $domain is used to lookup the $selector override (if any), similar to how the config here works. Assuming selector_maps is compatible with multiple selectors as well, then the only difference from this config below is configuring different path which we don't really need, and a similar setting path_maps supports.

This feedback has been migrated to a separate TODO issue: #3778

Worth noting perhaps, the default for $domain in the config has eSLD normalization enabled, which means some configurations (like hello@marketing.example.com) won't have a valid direct match (normalizes $domain to example.com).

I think that applies regardless of config approach. Just mentioning for maintainers to be aware of if that ever comes up as a reported problem in future 😅

Worth noting perhaps, the default for $domain in the config has eSLD normalization enabled, which means some configurations (like hello@marketing.example.com) won't have a valid direct match (normalizes $domain to example.com).

I think that applies regardless of config approach. Just mentioning for maintainers to be aware of if that ever comes up as a reported problem in future 😅

This can probably be configured with use_esld = true;?

This can probably be configured with use_esld = true;?

Yes, just raising awareness about it since it may show up some day as a bug report. If it does it's a simple documentation fix for rspamd/faq page(s) to communicate awareness to users.

It's probably unlikely that use_esld needs to be set to false? This is just storage of the private key within DMS for signing, and it's ok to use the same DKIM private key for various sender subdomains? (AFAIK they can all point to the same public key DNS record, or individual DNS records with the same public key)

@denisix please address the PR feedback; we can then go ahead and merge the PR.

last ping @denisix

As the contributor is not engaging with review feedback, I'll apply my change suggestion.

DMS could better manage this internally and simplify on configuration a user needs to be aware of and manually manage via docs, but that'll need someone to contribute the change. A separate issue for tracking that with all the information discussed here has been opened.

Regarding the concern with use_esld = true and DKIM related rspamd bug reports, maintainers should be aware of this behaviour where it can affect some users that deviate from our happy path of hostname: mail.example.com with user@example.com mail domains if they have trouble with $domain expecting to match a marketing.example.com (eSLD normalization will look for example.com instead, which may not work if the user has user@marketing.example.com accounts?), instead of example.com (which is probably what they should adjust for, it's ok to use the same key for subdomains).

Since that setting has nothing to do with the contribution here, it's already true in the docs above, I'll go ahead and merge 👍 (we could improve on the docs a bit more by explaining the suggested config further though, especially with the path that isn't actually valid presently)

This feedback has been migrated to a separate TODO issue: #3778

This context with source citing is now also part of the related TODO issue: #3778

Documentation preview for this PR is ready! 🎉

Built with commit: 405be2c

This path is wrong, currently the keys are in: /tmp/docker-mailserver/opendkim/keys/

I have used path = "/etc/opendkim/keys/$domain/$selector.private"; until now

This path is wrong

It's an example and was explicitly changed to that by me for the docs.

The contributor used /tmp/docker-mailserver/... instead of /etc/... but otherwise they also referred to opendkim.

Not sure why you'd want OpenDKIM as the path for rspamd though? I want this to be a unified location for DKIM keys, but someone will need to contribute that change.

Well, it's more that rspamd wanted to do signing before I would even know it. So I patched the path and selector to use open dkim path. Since opendkim was the first dkim stuff I had setup
Just feels like there is too many moving components in DMS and without a diagram I can not decide to shut down one component or another.
Anyway this config allows to local dkim sign and that's all I needed to pass 👍

Update dkim_dmarc_spf.md

02f09ef

using DKIM signing in Rspamd - automatically match keys for domains in dkim_signing.conf

polarathene requested changes Dec 16, 2023

View reviewed changes

polarathene changed the title Update dkim_dmarc_spf.md docs: Rspamd DKIM config simplify via path setting Dec 16, 2023

polarathene added kind/improvement Improve an existing feature, configuration file or the documentation area/documentation service/security/dkim-dmarc-spf service/security/rspamd labels Dec 16, 2023

polarathene added this to the v13.1.0 milestone Dec 16, 2023

polarathene mentioned this pull request Dec 23, 2023

[TODO]: Consider revising DKIM generation #3630

Open

georglauterbach modified the milestones: v13.1.0, v14.0.0 Dec 29, 2023

georglauterbach self-requested a review December 29, 2023 13:25

polarathene mentioned this pull request Jan 14, 2024

[TODO]: Consider rspamd DKIM config to use selector_map #3778

Open

polarathene previously approved these changes Jan 14, 2024

View reviewed changes

polarathene dismissed their stale review via 2a0af43 January 14, 2024 23:59

Update docs/content/config/best-practices/dkim_dmarc_spf.md

2a0af43

polarathene requested changes Jan 15, 2024

View reviewed changes

Comment thread docs/content/config/best-practices/dkim_dmarc_spf.md Outdated

polarathene added 2 commits January 15, 2024 13:05

Update docs/content/config/best-practices/dkim_dmarc_spf.md

a041eea

Merge branch 'master' into patch-1

405be2c

polarathene approved these changes Jan 15, 2024

View reviewed changes

polarathene merged commit ce6ebcc into docker-mailserver:master Jan 15, 2024

georglauterbach modified the milestones: v14.0.0, v13.3.0 Jan 15, 2024

williamdes reviewed Jan 20, 2024

View reviewed changes

pitilux mentioned this pull request Sep 5, 2024

bug report: Rspamd DKIM private key file '/tmp/docker-mailserver/rspamd/dkim/$domain/$selector.private' is configured for usage, but does not appear to exist #4172

Closed

1 task

polarathene mentioned this pull request Sep 28, 2024

scripts: improve DKIM path scanning in Rspamd setup #4201

Merged

8 tasks

+                      # The path location is searched for a DKIM key with these variables:
+                      # - `$domain` is sourced from the MIME mail message `From` header
+                      # - `$selector` is configured for `mail` (as a default fallback)
+                      path = "/tmp/docker-mailserver/dkim/keys/$domain/$selector.private";

		selector = "mail";
		path = "/tmp/docker-mailserver/opendkim/keys/$domain/$selector.private"; # this will automatically match keys for domains

+                      selector = "mail";
+                      path = "/tmp/docker-mailserver/opendkim/keys/$domain/$selector.private"; # this will automatically match keys for domains
+                      # domain specific configurations can be provided below:

docs: Rspamd DKIM config simplify via `path` setting by denisix · Pull Request #3702 · docker-mailserver/docker-mailserver · GitHub

Uh oh!

Uh oh!

docs: Rspamd DKIM config simplify via path setting - #3702

docs: Rspamd DKIM config simplify via path setting#3702polarathene merged 4 commits intodocker-mailserver:masterdocker-mailserver/docker-mailserver:masterfrom denisix:patch-1denisix/docker-mailserver:patch-1Copy head branch name to clipboard

Conversation

denisix commented Dec 16, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Type of change

Checklist:

Uh oh!

polarathene left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

polarathene commented Dec 17, 2023

Uh oh!

georglauterbach commented Dec 19, 2023

Uh oh!

polarathene commented Dec 19, 2023

Uh oh!

georglauterbach commented Dec 29, 2023

Uh oh!

georglauterbach commented Jan 10, 2024

Uh oh!

polarathene left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Jan 15, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

docs: Rspamd DKIM config simplify via path setting#3702
polarathene merged 4 commits into
docker-mailserver:masterfrom
denisix:patch-1

denisix commented Dec 16, 2023 •
edited
Loading

polarathene left a comment •
edited
Loading