我刚刚配置了 opendkim 和 postfix，它应该对我的电子邮件进行签名，但是却没有。
我用了/usr/sbin/opendkim-testkey测试按键，似乎没问题，但我发给[电子邮件保护]继续说：
==========================================================
Summary of Results
==========================================================
SPF check: pass
DomainKeys check: pass
DKIM check: neutral
Sender-ID check: pass
SpamAssassin check: ham
有什么想法吗？我有Postfix 配置文件像这样：
# OpenDKIM
milter_default_action = accept
milter_protocol = 6
smtpd_milters = , inet:127.0.0.1:8891, inet:127.0.0.1:12768
non_smtpd_milters = $smtpd_milters
我确实多次检查了我的日志文件，似乎没有什么问题。我正在使用 Centos 6。
这也是我的opendkim.conf
## BASIC OPENDKIM CONFIGURATION FILE
## See opendkim.conf(5) or /usr/share/doc/opendkim/opendkim.conf.sample for more
## BEFORE running OpenDKIM you must:
## - make your MTA (Postfix, Sendmail, etc.) aware of OpenDKIM
## - generate keys for your domain (if signing)
## - edit your DNS records to publish your public keys (if signing)
## See /usr/share/doc/opendkim/INSTALL for detailed instructions.
## CONFIGURATION OPTIONS
# Specifies the path to the process ID file.
PidFile /var/run/opendkim/opendkim.pid
# Selects operating modes. Valid modes are s (sign) and v (verify). Default is v.
# Must be changed to s (sign only) or sv (sign and verify) in order to sign outgoing
# messages.
Mode v
# Log activity to the system log.
Syslog yes
# Log additional entries indicating successful signing or verification of messages.
SyslogSuccess yes
# If logging is enabled, include detailed logging about why or why not a message was
# signed or verified. This causes an increase in the amount of log data generated
# for each message, so set this to No (or comment it out) if it gets too noisy.
LogWhy yes
# Attempt to become the specified user before starting operations.
UserID opendkim:opendkim
# Create a socket through which your MTA can communicate.
Socket inet:8891@localhost
# Required to use local socket with MTAs that access the socket as a non-
# privileged user (e.g. Postfix)
Umask 002
# This specifies a text file in which to store DKIM transaction statistics.
# OpenDKIM must be manually compiled with --enable-stats to enable this feature.
#Statistics /var/spool/opendkim/stats.dat
## SIGNING OPTIONS
# Selects the canonicalization method(s) to be used when signing messages.
Canonicalization relaxed/relaxed
# Domain(s) whose mail should be signed by this filter. Mail from other domains will
# be verified rather than being signed. Uncomment and use your domain name.
# This parameter is not required if a SigningTable is in use.
#Domain example.com
# Defines the name of the selector to be used when signing messages.
Selector mail
# Specifies the minimum number of key bits for acceptable keys and signatures.
MinimumKeyBits 1024
# Gives the location of a private key to be used for signing ALL messages. This
# directive is ignored if KeyTable is enabled.
KeyFile /etc/opendkim/keys/default.private
# Gives the location of a file mapping key names to signing keys. In simple terms,
# this tells OpenDKIM where to find your keys. If present, overrides any KeyFile
# directive in the configuration file. Requires SigningTable be enabled.
KeyTable /etc/opendkim/KeyTable
# Defines a table used to select one or more signatures to apply to a message based
# on the address found in the From: header field. In simple terms, this tells
# OpenDKIM how to use your keys. Requires KeyTable be enabled.
SigningTable refile:/etc/opendkim/SigningTable
# Identifies a set of "external" hosts that may send mail through the server as one
# of the signing domains without credentials as such.
ExternalIgnoreList refile:/etc/opendkim/TrustedHosts
# Identifies a set "internal" hosts whose mail should be signed rather than verified.
InternalHosts refile:/etc/opendkim/TrustedHosts
顺便说一下，这是我的日志：
May 29 07:34:07 s18378428 opendkim[5801]: OpenDKIM Filter v2.10.1 starting (args: -x /etc/opendkim.conf -P /var/run/opendkim/opendkim.pid)
May 29 07:35:02 s18378428 opendkim[5801]: 5562C18C60060: verifier.port25.com [38.95.177.125] not internal
May 29 07:35:02 s18378428 opendkim[5801]: 5562C18C60060: not authenticated
May 29 07:35:02 s18378428 opendkim[5801]: 5562C18C60060: DKIM verification successful
谢谢你的时间。
PD：为了以防万一，我获得了正确的 DNS 记录和我的域名的正确密钥。
答案1
在你的opendkim.conf文件中
Mode v
将操作模式设置为仅验证，因此您发出的邮件将永远不会被签名。
相关行上方的注释对此进行了解释：
选择操作模式。有效模式为 s（签名）和 v（验证）。默认为 v。
必须更改为 s（仅签名）或 sv（签名和验证）才能对发出的
消息进行签名。
我怀疑你的日志条目来自收到的邮件（即来自verifier.port25.com）已验证而不是外发邮件签。
用于签署传出消息的“良好”日志条目将是
opendkim[23616]: 085726031E: DKIM-Signature header added (s=mail1, d=example.tld)