DKIM filter for OpenSMTPD
Find a file
2023-04-10 00:31:22 +02:00
.github/workflows Update the CI 2023-03-26 18:42:18 +02:00
migrations Store the dates using unix timestamps 2023-04-10 00:30:31 +02:00
src Store the dates using unix timestamps 2023-04-10 00:30:31 +02:00
test_samples Update test samples 2023-03-24 22:13:05 +01:00
.gitignore First commit 2023-03-19 14:59:32 +01:00
build.rs Connect to the key database 2023-04-09 17:21:17 +02:00
Cargo.toml Generate keys 2023-04-09 23:31:16 +02:00
deny.toml Allow the Unicode-DFS-2016 license 2023-03-26 18:35:01 +02:00
LICENSE-APACHE-2.0.txt Include the licenses 2023-03-26 14:51:39 +02:00
LICENSE-MIT.txt Include the licenses 2023-03-26 14:51:39 +02:00
README.md Add an entry to the FAQ regarding manual key revocation 2023-04-10 00:31:22 +02:00
rustfmt.toml First commit 2023-03-19 14:59:32 +01:00

Filter DKIMout

Build Status Minimum rustc version License MIT OR Apache 2.0

DKIM filter for OpenSMTPD.

Project status

This is a work in progress, it is not supposed to work yet.

Building and packaging

cargo build --release

Packagers may want to set the VARLIBDIR to a custom value (default is /var/lib):

VARLIBDIR="/usr/local/var/lib" cargo build --release

Frequently Asked Questions

Does this filter signs outgoing emails using DKIM or check the DKIM signature of incoming emails?

It only signs outgoing emails.

Why create another filter for that?

Currently, the options to sign outgoing emails with DKIM are the following:

DKIMproxy is not an OpenSMTPD filter and is therefore more inconvenient to use. Moreover, its development stopped in 2013 and it is therefore dangerous to use.

The two other are fine, however I think they lack a few features, like automatic key rotation and publication of obsolete private keys.

Why would anyone publish private keys, even obsolete ones? Are you crazy?

DKIM's goal is to fight spam, that's all, and for that it only need the keys to be safe when the recipients receives the email. But because it includes a cryptographic proof over the content it is being used for other usages, mostly as a legal proof long after the email has been sent and received. Publishing the obsolete/revoked private keys allows the sender to regain deniability.

Matthew Green wrote an excellent article on this subject: Ok Google: please publish your DKIM secret keys.

Where is the documentation?

A man page will be available by the time this filter is ready to use.

One of my keys has been compromised, how do I revoke it?

Keys are stored in an SQLite format 3 database. You may access it using the sqlite3 CLI tool or any other compatible tool.

The simplest way to revoke a key is to set its not_after field at the current timestamp. A new key will automatically be generated.

UPDATE key_db SET not_after = unixepoch() WHERE selector = 'dkim-755512d8f51b4da6936d565a1ddbaf17';