As far as I know, I've followed all the instructions in this post from Steve Jenkins about how to install and configure opendkim for sendmail under CentOS.


Everything on the server seems to work - I don't see any errors in maillog or when I restart sendmail or opendkim.

But when I use Port25's email checking tool (sending email to check-auth@verifier.port25.com from the server), I get a fail, saying the signature doesn't verify.

DKIM check details:
Result:         fail (signature doesn't verify)
ID(s) verified:
Canonicalized Headers:

Canonicalized Body:

DNS record(s):
    default._domainkey.tidbits.com. 120 IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD5c8Qbiw2aLlYk9ewZiVpEL3TwABiRZqIf3tlKtVmkj5QTEfWLjNsnkQ+p+o/IbO7tzXypaGso3dfqVVz/WftpqsXQLT9Yd9VZn8qyeMnOBcSl7Xj0McMFmdGmnpHR8KX+/tiYJL169UPo6EotcLRXbW63ZbNnft5W4FBSvhrP2QIDAQAB"

Public key used for verification: default._domainkey.tidbits.com (1024 bits)

NOTE: DKIM checking has been performed based on the latest DKIM specs
(RFC 4871 or draft-ietf-dkim-base-10) and verification may fail for
older versions.  If you are using Port25's PowerMTA, you need to use
version 3.2r11 or later to get a compatible version of DKIM.

Similarly, if I use Brandon Checketts' Email Validator at http://www.brandonchecketts.com/emailtest.php, I get a similar sounding fail, saying the message has been altered:

DKIM Signature

Message contains this DKIM Signature:
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tidbits.com;
    s=default; t=1401825040;

Signature Information:
v= Version:         1
a= Algorithm:       rsa-sha256
c= Method:          relaxed/simple
d= Domain:          tidbits.com
s= Selector:        default
q= Protocol:        
bh=                 z6rEhTm6k/MRH02Uwz6CoDfNxAxYcEAZxvynRlx4keQ=
h= Signed Headers:  Subject:Date:To:From
b= Data:            B7XhogAmuX1/FsHKdxVQBvYy3x2CXo+RvcmTqgVqUQ3zhee9Wfc5tQf+l+tGPqWSY
Public Key DNS Lookup

Building DNS Query for default._domainkey.tidbits.com
Retrieved this publickey from DNS: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD5c8Qbiw2aLlYk9ewZiVpEL3TwABiRZqIf3tlKtVmkj5QTEfWLjNsnkQ+p+o/IbO7tzXypaGso3dfqVVz/WftpqsXQLT9Yd9VZn8qyeMnOBcSl7Xj0McMFmdGmnpHR8KX+/tiYJL169UPo6EotcLRXbW63ZbNnft5W4FBSvhrP2QIDAQAB
Validating Signature

result = fail
Details: message has been altered

These test messages are being sent from an internal tool that was written for us; it creates messages for sendmail to send out. Could the problem be related to when the DKIM headers are being added to the messages?

  • did you manage to resolve this? – designcise Aug 6 '15 at 20:18
  • No, I never really solved this. My current belief is that there's something wrong with the testers, since all the DKIM setup I did seems to be accepted by mail servers. – Adam C. Engst Aug 18 '15 at 21:00
  • I managed to resolve this. We had our domain registered elsewhere than our hosting service, and turns out there was a conflict between dkims. Had to uninstall dkim from the host (which can be done via SSH or through WHM). Hope that helps. – designcise Aug 19 '15 at 6:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.