Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace opendkim with dkimpy #2220

Open
wants to merge 7 commits into
base: main
Choose a base branch
from

Conversation

kiekerjan
Copy link
Contributor

This pull request migrates the current usage of OpenDKIM to dkimpy. OpenDKIM did not have any upstream releases for a long time, and might be considered no longer maintained. Dkimpy seems a good replacement.

Changes:

  • Use dkimpy-milter package as provided by Ubuntu to replace opendkim package
  • Implement ed25519 signing in addition to the rsa signing

dkimpy also supports ARC (RFC 8617 Authenticated Received Chain), but this pull request does nothing with that.

Tested by spinning up a box with this branch, then sending and receiving email from and to the box. Both signing and verifying of both dkim signatures (rsa and ed25519) are working.

Thanks to https://colincogle.name/blog/replacing-opendkim/ for inspiration for these changes.

@downtownallday
Copy link
Contributor

Can the existing DKIM keys (mail.private and mail.txt) be re-used instead of creating new ones? This might avoid some trouble especially for those using third-party dns.

@kiekerjan
Copy link
Contributor Author

That's a good point. When I configured this I made it so that I could easily switch it with the old situation, including changing the selector, port number etc. I did not think about the migration situation anymore.
As far as I can see, it should be possible to re-use the existing RSA keys. I'll put something together.

@kiekerjan
Copy link
Contributor Author

Not yet tested.
I kept the naming convention of having the dkim selectors reflected in the dkim key filenames.

@kiekerjan
Copy link
Contributor Author

Tested as follows:

  • Clean installation of this branch.
  • Clean installation of mailinabox, then upgraded using this branch.

Both installations were able to sign and verify the rsa and the ed25519 keys. Looks good to me.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants