Comprehensive DKIM Signing with OpenDKIM: 2048-bit Key Rollover and Postfix Milters

DKIM (DomainKeys Identified Mail) provides an essential cryptographic signature verifying that an email message originated from an authorized domain and that its body and header contents have not been altered in transit. In 2026, major mailbox providers automatically reject or place into the spam folder any unsigned transactional messages.

Implementing OpenDKIM as a Postfix Milter (Mail Filter) with robust 2048-bit RSA keys and establishing a zero-downtime key rotation protocol ensures uninterrupted deliverability and high sender reputation.

When an email is signed with DKIM, OpenDKIM calculates a SHA-256 cryptographic hash of the message body and selected headers (From, To, Subject, Date, Message-ID). It signs this hash with the domain owner's private key and attaches the resulting base64 signature in a DKIM-Signature header. Receiving mail servers extract the selector name (s=) and domain (d=) from the header, query DNS for the public key at selector._domainkey.domain.com, and verify the signature. If any intermediary changes a link, alters the recipient, or injects spam headers, the signature hash mismatch causes DKIM validation to fail.

Expand

Generating 2048-Bit RSA Keys with OpenDKIM

Create dedicated directories and generate a timestamped selector key:

# Create directory structure with secure permissions
sudo mkdir -p /etc/opendkim/keys/example.com
sudo chown -R opendkim:opendkim /etc/opendkim

# Generate 2048-bit RSA key pair with selector s2026
sudo opendkim-genkey -b 2048 -d example.com -s s2026 -D /etc/opendkim/keys/example.com/
sudo chown opendkim:opendkim /etc/opendkim/keys/example.com/s2026.private
sudo chmod 600 /etc/opendkim/keys/example.com/s2026.private

The file s2026.txt contains the exact DNS TXT record string to publish at s2026._domainkey.example.com. In modern email security, 1024-bit keys are considered cryptographically weak and are actively penalized by Gmail and Yahoo algorithms; 2048-bit RSA keys are the baseline requirement.

Configuring OpenDKIM Tables and Milter Daemon

Configure /etc/opendkim.conf and define the KeyTable and SigningTable:

# /etc/opendkim.conf
Syslog                  yes
SyslogSuccess           yes
Canonicalization        relaxed/simple
Mode                    sv
SubDomains              no
AutoRestart             yes
AutoRestartRate         10/1h
OversignHeaders         From
Socket                  local:/var/spool/postfix/opendkim/opendkim.sock

KeyTable                /etc/opendkim/KeyTable
SigningTable            /etc/opendkim/SigningTable
ExternalIgnoreList      /etc/opendkim/TrustedHosts
InternalHosts           /etc/opendkim/TrustedHosts

The directive Canonicalization relaxed/simple is critical: it allows for minor whitespace adjustments that mail relays commonly make to message headers without invalidating the cryptographic signature, preventing false-positive delivery rejections.

Populate /etc/opendkim/KeyTable:

s2026._domainkey.example.com example.com:s2026:/etc/opendkim/keys/example.com/s2026.private

Populate /etc/opendkim/SigningTable:

*@example.com s2026._domainkey.example.com

And /etc/opendkim/TrustedHosts:

127.0.0.1
localhost
10.0.0.0/8
*.example.com

Hooking OpenDKIM into Postfix

In /etc/postfix/main.cf, connect Postfix to the OpenDKIM unix domain socket:

# Milter configuration
milter_default_action = accept
milter_protocol = 6
smtpd_milters = unix:opendkim/opendkim.sock
non_smtpd_milters = unix:opendkim/opendkim.sock

Restart both services:

sudo systemctl restart opendkim postfix
sudo opendkim-testkey -d example.com -s s2026 -k /etc/opendkim/keys/example.com/s2026.private -vvv

When the DNS TXT record has propagated, opendkim-testkey returns "key OK", confirming full cryptographic validation.

Deploying OpenDKIM protects your transactional email stream from spoofing and guarantees high inbox placement.

You can spin up an Ubuntu 24.04 instance on Netbay in under 60 seconds with Intel Xeon Platinum compute and high-speed SSD storage in Lucknow — netbayhosts.in.