FILTER-DKIMOUT(8)

NAME
filter-dkimout - DKIM filter for OpenSMTPD

SYNOPSIS
filter-dkimout [-a|--algorithm STRING] [-b|--key-data-base FILE] [-c|--canonicalization STRING] [-d|--domain STRING] [-D|--domain-file FILE] [-f|--revocation-list FILE] [-h|--header STRING] [-o|--header-optional STRING] [-p|--cryptoperiod UINT] [-r|--revocation UINT] [-u|--dns-update-cmd STRING] [-v|--verbose] [-V|--version] [-x|--expiration UINT]

DESCRIPTION
filter-dkimout is an OpenSMTPD filter for OpenSMTPD that signs outgoing emails using DKIM. It provides automatic key generation and rotation.

The options are as follows:

-a, --algorithm STRING
    The signing algorithm. Possible values are:

    -   ed25519-sha256
    -   rsa2048-sha256 <default>
    -   rsa3072-sha256
    -   rsa4096-sha256

-b, --key-data-base FILE
    Path to an SQLite 3 database where keys are stored. Will be created if does not exists.

-c, --canonicalization STRING
    The canonicalization algorithm used to generate the signature. Must be composed of two methods separated by a slash character. The first method will be used for the headers and the second one for the body. Available methods are:

    -   simple
    -   relaxed

    Default is " relaxed/relaxed ".

-d, --domain STRING
    A domain name for which it is possible to sign for. Multiple -d options are additive.

-D, --domain-file FILE
    Path to a file witch contains a domain name on each line.

-f, --revocation-list FILE
    Path to the revocation list file. Will be created if does not exists. This file is opened in append mode, which means previous content will not be deleted.

-h, --header STRING
    Header that will always be included in the signature, even if not present. It is possible to specify multiple headers separated by a colon. Multiple -h options are additive. Set to an empty string to deactivate.

    Default is " from:reply-to:subject:date:to:cc ".

-o, --header-optional STRING
    Header that will be included in the signature only if present. It is possible to specify multiple headers separated by a colon. Multiple -o options are additive. Set to an empty string to deactivate.

    Default is " resent-date:resent-from:resent-to:resent-cc:in-reply-to:references:list-id:list-help:list-unsubscribe:list-subscribe:list-post:list-owner:list-archive ".

-p, --cryptoperiod UINT
    The cryptoperiod, in seconds. Default is 15552000 <180 days>.

-r, --revocation UINT
    Number of seconds between the end of the cryptoperiod and the revocation. Default is 1728000 <20 days>.

-u, --dns-update-cmd STRING
    Command that will be executed to update DNS entries.

-v, --verbose
    Verbose mode. Multiple -v options increase the verbosity. The maximum is 2.

-V, --version
    Display the version number and exit.

-x, --expiration UINT
    Signature expiration, in seconds. Default is 1296000 <15 days>. Set to 0 to deactivate.

SEE ALSO
smtpd-filters(7)

STANDARDS

-   D. Crocker, September 2011, RFC 6376, DomainKeys Identified Mail (DKIM) Signatures.

-   J. Levine, September 2018, RFC 8463, A New Cryptographic Signature Method for DomainKeys Identified Mail (DKIM).

AUTHORS
Rodolphe Bréard <rodolphe@breard.tf>