1

The mail.err has this (I've used FQDN.example.com as a marker for my domain):

Mar 24 19:08:31 FQDN opendkim[17649]: can't load key from /etc/opendkim/keys/FQDN.example.com/mail.private: Permission denied
Mar 24 19:08:31 FQDN opendkim[17649]: D1EBB1204E1: error loading key 'mail._domainkey.FQDN.example.com'

But when I run opendkim-testkey -d FQDN.example.com -s mail -vvvvv I get

opendkim-testkey: using default configfile /etc/opendkim.conf
opendkim-testkey: checking key 'mail._domainkey.FQDN.example.com'
opendkim-testkey: key not secure
opendkim-testkey: key OK

The reason the key is not secure because I set it to chmod 777 when I thought that the denied permissions had something to do with the file permissions. What is going on here?

Using Debian 10.

3 Answers 3

1

In my case helped this

chown -R opendkim:opendkim /etc/opendkim
chmod 0750 /etc/opendkim/keys
chmod 0600 /etc/opendkim/keys/default.private
0

If its a permission issue, try tighter settings.

chmod 0600
1
  • 1
    This chmod command is missing some pieces...
    – Jeff Schaller
    Commented Apr 30, 2021 at 14:26
0

You've got two issues, one brought about by an incorrect attempt at a fix for the other

Mar 24 19:08:31 FQDN opendkim[17649]: can't load key from /etc/opendkim/keys/FQDN.example.com/mail.private: Permission denied

This error is telling you that the account running opendkim cannot read the file mail.private (or one of the intermediate directories).

opendkim-testkey: key not secure

This is telling you that the permissions on this file (or one of the intermediate directories) are too lax.

You need to ensure that the account running opendkim can access the private key, but that no other group or process can do so. Unfortunately I don't run OpenDKIM so I cannot tell you what the correct value should be, but remember permissions are user-group-other, so chmod 0600 mail.private might be acceptable and sufficient if the user running opendkim owned the file.

Also see OpenDKIM errors over on ServerFault.

3
  • 1
    This is incorrect: ‘key not secure’ indicates only that the public key was fetched without DNSSEC. If DNSSEC can be used, the output will be ‘key secure’. But this is unrelated from local private key permissions.
    – glts
    Commented Apr 4, 2020 at 12:38
  • @glts Can you provide the source for your statement?
    – 71GA
    Commented Jan 4, 2021 at 12:14
  • @71GA I don’t think this is well documented … but see the source code of opendkim-testkey.
    – glts
    Commented Jan 4, 2021 at 14:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .