Recommended Free Tools
To sign outbound mail, run OpenDKIM beside Postfix, publish OpenDKIM’s public key at selector._domainkey.yourdomain, and connect the signer to Postfix with Milter settings. Postfix does not create the DKIM signature itself. A working setup requires the selector, domain, private-key path, OpenDKIM socket, and DNS TXT record to match exactly.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What DKIM does in a Postfix setup
DomainKeys Identified Mail (DKIM) adds a cryptographic signature to outgoing messages. The receiving server uses the public key in DNS to check that the message was authorized by the signing domain and that signed headers and body content were not changed after signing.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
In this arrangement, Postfix is the mail transport agent and OpenDKIM is the signing service. Postfix passes each message to OpenDKIM through the Milter protocol. OpenDKIM hashes the selected message data, adds a DKIM-Signature header, and returns the message to Postfix for delivery. Installing OpenDKIM alone does not make Postfix sign mail; Postfix must be configured to reach the correct OpenDKIM socket.
The public and private halves of the key pair have different homes:
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
- The private key remains on the VPS and must be readable by the OpenDKIM service but not by ordinary users.
- The public key is published as a DNS TXT record at the selector-specific name, such as
mail._domainkey.yourdomain.example.
Recipients use the selector in the message’s signature to find that exact DNS record. A mismatch in even one of these values can produce a failed lookup or an unsigned message.
Prerequisites and scope
This procedure targets a Debian-family Linux VPS running outbound Postfix mail. Before changing configuration, have all of the following ready:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →- A domain whose DNS zone you can edit.
- A functioning Postfix installation that can send mail.
- A stable VPS hostname and working outbound SMTP configuration.
- Administrative access through
sudo. - A mailbox you control for receiving and inspecting a test message.
Distribution packages can choose different service users, paths, defaults, and chroot layouts. Confirm the values installed on your VPS instead of assuming that every Linux distribution uses the Debian layout shown here. This guide covers outbound signing; DKIM verification of incoming mail, DMARC policy publication, and provider-specific DNS screens are separate tasks.
How the values must line up
Choose one domain and selector first, then carry the same values through every layer. In the examples below, the domain is yourdomain.example and the selector is mail.
| Component | Example value | Why it matters |
|---|---|---|
| Signing domain | yourdomain.example |
OpenDKIM signs for this domain and the receiver evaluates its DNS key. |
| Selector | mail |
Identifies one key at mail._domainkey.yourdomain.example and permits later key rotation. |
| Private key | /etc/dkimkeys/mail.private |
Read locally by OpenDKIM; never publish this file. |
| Public-key TXT owner | mail._domainkey.yourdomain.example |
Must be the exact selector and domain combination in the signature. |
| OpenDKIM socket | inet:8891@localhost |
Postfix uses this endpoint to submit messages to the signer. |
For a single domain and key, the direct settings are easiest to audit. If you later sign multiple domains or use several selectors, replace the single-key mapping with KeyTable and SigningTable; that change is explained below.
Install OpenDKIM and its utilities
On Debian-family systems, install the signer and its test tools:
sudo apt install opendkim opendkim-toolsThe utilities include opendkim-genkey for creating a key pair and opendkim-testkey for checking that DNS and the local key configuration agree. If your distribution uses another package manager, install the equivalent OpenDKIM daemon and utility package, then check the package documentation for its service name and configuration paths.
Generate and protect a selector key pair
Create a dedicated key directory
Create a directory outside the web root and other application data:
sudo mkdir -p /etc/dkimkeysKeeping keys in a dedicated directory makes ownership and backup decisions clear. Do not place a private key in a public document directory or in a repository.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Generate the key
Run the generator as the OpenDKIM service account, using the domain and selector you intend to publish:
sudo -u opendkim opendkim-genkey -D /etc/dkimkeys -d yourdomain.example -s mailThis creates a private key such as mail.private and a DNS-ready public-key file such as mail.txt. Debian’s documented default is a 2048-bit key. That is the normal choice when your DNS provider accepts the resulting TXT value.
Some DNS systems impose a 255-character limit on an individual TXT string. If the provider cannot accept a 2048-bit public key in its supported format, use the provider’s method for splitting one TXT record into multiple quoted strings. The Debian documentation also describes generating a smaller key with -b 1024 as an alternative, but that reduces cryptographic strength and should be treated as a compatibility compromise rather than a first choice.
Set ownership and permissions
The daemon must be able to read the private key, while unrelated users must not. Debian’s example assigns the files to the OpenDKIM account:
sudo chown opendkim.opendkim /etc/dkimkeys/mail.*Preserve restrictive modes in the package layout on your distribution. Check both the file mode and every parent directory’s execute permission. OpenDKIM can also reject unsafe permissions when its RequireSafeKeys behavior is enabled. If the service logs a permission or “unsafe key” error, inspect the owner, mode, path, and the account under which the daemon actually runs.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsPublish the public key in DNS
Use the exact selector owner name
Open the generated /etc/dkimkeys/mail.txt file and copy its complete TXT value. Create a DNS TXT record with this owner name:
mail._domainkey.yourdomain.exampleThe value begins with v=DKIM1; and includes the public-key material in the p= tag. Do not copy the private-key file. A DNS control panel may ask for the host as only mail._domainkey when the zone is already yourdomain.example; follow that panel’s convention without accidentally appending the domain twice.
Preserve the complete TXT value
Copy every character from the generated public-key record, including all text after p=. Some providers display a long value as several quoted strings. That is still one DNS TXT record; use the provider’s supported split-string interface rather than creating different records with different names. Debian’s example uses a TTL of 3600 seconds and identifies an RSA/SHA-256 key, but that TTL is an example, not a universal requirement.
Allow time for DNS propagation according to your provider’s TTL. Query the authoritative result before testing OpenDKIM, and make sure the response contains the full key rather than a truncated value.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Configure OpenDKIM
Single domain and single selector
For one domain and one key, set the essential options in the OpenDKIM configuration used by your package:
Domain yourdomain.example
Selector mail
KeyFile /etc/dkimkeys/mail.private
Socket inet:8891@localhostThe option names are whitespace-separated in the traditional configuration format. The Domain, Selector, and KeyFile values must describe the same key pair that you published in DNS. The Socket value exposes OpenDKIM on TCP port 8891 on the local host.
A UNIX-domain socket is another valid design, but its filesystem path must be reachable by Postfix, including when Postfix runs in a chroot. A TCP localhost socket avoids some path and chroot issues, while a UNIX socket can limit communication to a filesystem endpoint. Whichever form you choose, use the identical address and protocol in Postfix.
Multiple domains or selectors
When one static KeyFile is no longer enough, define a KeyTable that maps a key name to a domain, selector, and private-key path. Use a SigningTable to select that key based on the sender identity. OpenDKIM’s manual states that KeyTable overrides KeyFile; when a KeyTable is defined, the standalone Selector setting is ignored.
A multi-key arrangement therefore needs three aligned pieces for every entry:
- The key-table mapping must point to the intended private-key file.
- The signing table must select that mapping for the appropriate sender or domain.
- The corresponding public key must be published at that entry’s selector and domain.
Keep selector names distinct during rotation or when several active keys coexist. Document which sender identities use each mapping so that a later edit does not silently sign a domain with the wrong key.
Connect Postfix to OpenDKIM with Milter
Edit /etc/postfix/main.cf and add the OpenDKIM socket to both Milter parameters:
smtpd_milters = inet:localhost:8891
non_smtpd_milters = $smtpd_milters
milter_default_action = acceptsmtpd_milters handles mail injected through Postfix’s SMTP server. non_smtpd_milters handles locally generated or otherwise non-SMTP-injected mail, such as messages created by a local application. Setting only the first parameter is a common reason that externally submitted test mail is signed while local notifications are not.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallmilter_default_action = accept tells Postfix to accept mail when the Milter is temporarily unavailable instead of rejecting or losing the message because the signer is down. This favors delivery continuity; monitor the service so a failed signer does not go unnoticed and leave new mail unsigned.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
If Postfix already has other milters, preserve them and separate entries with commas according to the syntax in the installed Postfix configuration. Verify that the socket protocol (TCP or UNIX), host, port or path, and chroot visibility all match OpenDKIM.
Restart, reload, and check service state
After saving the OpenDKIM settings, restart the signer and reload Postfix:
sudo systemctl restart opendkim
sudo systemctl reload postfixUse your distribution’s service manager if it differs from systemd. A reload applies Postfix configuration without unnecessarily stopping the mail queue; a restart is used here for OpenDKIM so the daemon reopens its configuration and key.
Before sending a message, check each service’s status and logs for syntax errors, permission failures, or socket-bind errors. If OpenDKIM cannot bind to port 8891, another process may already be using it. If Postfix reports a connection failure, compare the Milter address in main.cf with the active OpenDKIM socket and check whether a chroot prevents access.
Validate DNS and the local key before sending mail
Run the key test with the same domain and selector used in both configurations:
sudo opendkim-testkey -d yourdomain.example -s mail -vvvA successful result indicates that OpenDKIM can reconcile the local key setup with the TXT record published for that selector and domain. The verbose output is useful when diagnosing a wrong owner name, an incomplete public key, or a path mismatch. Run the test again after correcting DNS or permissions rather than relying on a cached or earlier result.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →This test does not prove that a complete message will traverse Postfix correctly. It checks key and DNS alignment; the final check must inspect a delivered message.
Send a controlled test and inspect the received headers
- Send a message from the configured domain to a mailbox you control.
- Open the message’s raw or “original” headers, not only the simplified mail-client view.
- Find a
DKIM-Signatureheader and note itsd=domain ands=selector. - Find the recipient’s
Authentication-Resultsheader and confirm it reportsdkim=pass. - Compare the observed
d=ands=values with the DNS record you tested.
The header check catches wiring problems that a key-only test cannot: an absent Milter connection, a missing non_smtpd_milters setting, an unexpected signing table match, or a message path that bypasses the intended Postfix instance.
Troubleshoot the failures that occur most often
“Key not secure” or a DNS lookup failure
- Confirm the record owner is exactly
selector._domainkey.yourdomain, including the selector spelling. - Query DNS for that full name and check that the response contains the entire
p=value. - Verify that the domain and selector passed to
opendkim-testkeyare identical to the OpenDKIM settings. - Check that your DNS provider did not append the zone name twice or silently truncate the TXT data.
No signature on locally generated mail
Check non_smtpd_milters first. Postfix treats locally generated mail separately from SMTP-injected mail, so a configuration containing only smtpd_milters can leave cron, application, or system notifications unsigned. Reload Postfix after correcting the setting and send a new message; an earlier message cannot gain a signature retroactively.
OpenDKIM cannot read the private key
- Check that the file path in
KeyFileis correct and that the file exists. - Confirm the file owner and group match the account running OpenDKIM.
- Use restrictive file modes and ensure every parent directory permits the daemon to traverse it.
- Review strict safe-key checks such as
RequireSafeKeysif the log reports unsafe permissions.
Do not solve a permissions error by making the private key world-readable. Correct ownership and directory access instead.
Free tools Windows power users keep installed
One-click scans. No signup required.
Postfix cannot connect to OpenDKIM
Compare the socket type and address on both sides. For inet:8891@localhost, confirm that OpenDKIM is listening on the local port and that Postfix uses the same host and port. For a UNIX socket, check that the socket file exists, its permissions permit Postfix access, and the path is visible from Postfix’s execution or chroot context.
The signature passes initially but fails after forwarding
A valid signature can be invalidated when a mailing list or intermediary rewrites signed headers or changes the body. Such downstream changes are outside the original Postfix signing step. If direct delivery passes but a forwarded copy fails, compare the headers and body between the two messages and identify which intermediary modified them.
The DNS TXT record appears truncated
Some DNS interfaces limit one text string to 255 characters. Use the provider’s documented method for splitting a single DKIM value into multiple quoted strings, then query the assembled record and rerun opendkim-testkey. If the provider cannot represent a 2048-bit value at all, the documented 1024-bit generation option is a possible compatibility fallback, with a corresponding reduction in key strength.
Choose the right configuration variant
| Decision | Option A | Option B | Practical implication |
|---|---|---|---|
| Key mapping | Single KeyFile, Domain, and Selector |
KeyTable plus SigningTable |
Use the single-key model for one domain; use tables for multiple domains, identities, or active selectors. |
| Socket | TCP localhost, such as inet:8891@localhost |
UNIX-domain socket | TCP is simple to reference; UNIX sockets require correct filesystem permissions and chroot visibility. |
| Canonicalization | simple |
relaxed |
These controls determine how header and body formatting is normalized before hashing. Choose deliberately when interoperability with intermediaries matters and keep the setting consistent with your OpenDKIM policy. |
| Domain coverage | One signing domain and selector | Several domains or selectors | More domains require explicit table mappings and a DNS key for every selector-domain pair. |
Do not add a KeyTable casually to a working single-key configuration: once it is defined, it takes precedence over KeyFile, and the standalone Selector is ignored. Plan the mapping and DNS records together before switching.
Operate the setup safely after it works
Keep private keys private
Back up private keys only in an access-controlled location, and do not include them in ticket attachments, public repositories, or web-served directories. If a key is exposed, generate a replacement selector, publish its new public key, update OpenDKIM, and remove the compromised key from active use after DNS and propagation considerations are handled.
Rotate with selectors instead of overwriting a live key
A selector lets old and new keys coexist. Generate a new selector key, publish its TXT record, configure OpenDKIM to use it, and verify a delivered message carries the new selector. Leave the old DNS record available long enough for messages signed before the change to be verified, then retire it according to your mail-flow requirements.
Monitor both signing and delivery
Because milter_default_action = accept allows mail through during a signer outage, service monitoring is important. Alert on OpenDKIM failures, Postfix Milter connection errors, and a sudden absence of DKIM-Signature headers in sampled outbound mail. A green service process alone is not proof that Postfix is submitting messages to it.
Quick Recap
A concise verification checklist
- Postfix is installed, sending mail, and uses the expected service account and paths.
opendkimandopendkim-toolsare installed.- The private key exists at the configured path and has restrictive ownership and permissions.
- The public key is published at the exact
selector._domainkey.domainname. - The OpenDKIM socket is listening and reachable from Postfix.
- Both
smtpd_miltersandnon_smtpd_miltersreference that socket. opendkim-testkey -d ... -s ... -vvvsucceeds with the production selector.- A newly delivered test message contains
DKIM-Signatureand reportsdkim=pass. - Any failure is checked against the exact selector, domain, path, owner, mode, and socket rather than a similarly named value.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
