我在 Ubuntu 18.04 LTS 上安装并配置了 OpenDKIM 和 SPF TXT 记录。但是,我无法解析我的 DKIM TXT 记录。我运行 NSD 作为我的 DNS 并配置为 mydomain.com.zone。
我的 mydomain.com 的 SPF 记录返回 OK:
root@host:# nslookup -q=txt mydomain.com
Server: 127.0.0.53
Address: 127.0.0.53#53
Non-authoritative answer:
mydomain.com text = "v=spf1 mx a ip4:1.2.3.4 -all"
Authoritative answers can be found from:
但是,我的 mydomain.com 的 DKIM 记录没有返回任何答案:
root@host# nslookup -q=txt mail._domainkey.mydomain.com
Server: 127.0.0.53
Address: 127.0.0.53#53
Non-authoritative answer:
*** Can't find mail._domainkey.mydomain.com: No answer
Authoritative answers can be found from:
针对公共 DNS 进行挖掘输出
root@host:# dig @8.8.8.8 mydomain.com TXT +short
"v=spf1 mx a ip4:1.2.3.4 -all"
root@host:# dig @8.8.8.8 mail._domainkey.mydomain.com TXT +short
root@host:#
区域文件:
root@host:#cat /etc/nsd/zones/mydomain.com.zone
$ORIGIN mydomain.com.
$TTL 1800
@ IN SOA ns1.mydomain.com. domains.mydomain.com. (
2018051301
3600
900
1209600
1800
)
@ IN NS ns1.mydomain.com.
@ IN NS ns2.mydomain.com.
@ IN A 1.2.3.4
@ IN MX 10 mail.mydomain.com.
@ IN TXT "v=spf1 mx a ip4:1.2.3.4-all"
mail._domainkey TXT (
"v=DKIM1\059 h=sha256\059 k=rsa\059 p=ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHI"
"ABCDEFGHIJKLMNOPQRSTUVWXYZ"
"ABCDEFGHIJKLMNOPQRSTUVWXYZ" )
ns1 IN A 1.2.3.4
ns2 IN A 1.2.3.4
www IN A 1.2.3.4
ftp IN A 1.2.3.4
mail IN A 1.2.3.4
* IN A 1.2.3.4
一切正常:
root@host:# nsd-checkzone mydomain.com mydomain.com.zone
zone mydomain.com is ok
但是,运行 opendkim-testkey 时,它返回“无密钥”错误:
root@host:# opendkim-testkey -d mydomain.com -s mail -vvv
opendkim-testkey: using default configfile /etc/opendkim.conf
opendkim-testkey: checking key 'mail._domainkey.mydomain.com'
opendkim-testkey: No key
配置输出:
root@host:# tree /etc/opendkim
/etc/opendkim
|-- keys
| `-- mydomain.com
| |-- mail.private
| `-- mail.txt
|-- key.table
|-- signing.table
`-- trusted.hosts
2 directories, 5 files
root@host:/# cat /etc/opendkim/key.table
mail._domainkey.mydomain.com mydomain.com:mail:/etc/opendkim/keys/mydomain.com/mail.private
root@host:/# cat /etc/opendkim/signing.table
*@mydomain.com mail._domainkey.mydomain.com
root@interconit:/# cat /etc/opendkim.conf
Syslog yes
SyslogSuccess Yes
LogWhy Yes
UMask 002
UserID opendkim:opendkim
KeyTable refile:/etc/opendkim/key.table
SigningTable refile:/etc/opendkim/signing.table
ExternalIgnoreList refile:/etc/opendkim/trusted.hosts
InternalHosts refile:/etc/opendkim/trusted.hosts
Canonicalization relaxed/simple
Mode sv
ADSPAction continue
AutoRestart yes
AutoRestartRate 10/1M
SignatureAlgorithm rsa-sha256
Socket inet:8891@localhost
PidFile /var/run/opendkim/opendkim.pid
OversignHeaders From
答案1
您必须重新加载 nsd-control reconfig 以使 DKIM TXT 更改生效。检查 nsd.conf 并确保区域条目指向正确的区域文件。
root@host:/etc/nsd# cat nsd.conf
server:
ip-address: 127.0.0.1
ip-address: 1.2.3.4
username: nsd
hide-version: yes
zonesdir: "/etc/nsd/zones/"
logfile: "/var/log/nsd.log"
pidfile: "/run/nsd/nsd.pid"
# zone entry for mydomain.com
zone:
name: mydomain.com
zonefile: mydomain.com.zone
root@host:/etc/nsd# vim nsd.conf
root@host:/etc/nsd# nsd-control reconfig
reconfig start, read /etc/nsd/nsd.conf
ok
root@host:/etc/nsd# opendkim-testkey -d mydomain.com -s mail -vvv
opendkim-testkey: using default configfile /etc/opendkim.conf
opendkim-testkey: checking key 'mail._domainkey.mydomain.com'
opendkim-testkey: key not secure
opendkim-testkey: key OK
root@host:/etc/nsd# dig @8.8.8.8 mail._domainkey.mydomain.com TXT +short
"v=DKIM1; h=sha256; k=rsa; p=ABCDEFGHIJKLMNOPQRSTUVWXYZ"
"ABCDEFGHIJKLMNOPQRSTUVWXYZ"
"ABCDEFGHIJKLMNOPQRSTUVWXYZ"
root@host:/etc/nsd# nslookup -q=txt mail._domainkey.mydomain.com
ns1.mydomain.com
Server: ns1.mydomain.com
Address: 1.2.3.4#53
mail._domainkey.mydomain.com text = "v=DKIM1; h=sha256; k=rsa;
p=ABCDEFGHIJKLMNOPQRSTUVWXYZ" "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
"ABCDEFGHIJKLMNOPQRSTUVWXYZ"