Ubuntu 20.04环境下OpenDKIM无法签名外发邮件问题排查求助

我跟着教程在Ubuntu 20.04上配置OpenDKIM+Postfix，目的是给外发邮件添加DKIM签名，但折腾了3天还是没搞定——所有步骤都按教程来，邮件能正常发送，但就是没有DKIM签名。一开始尝试用.sock套接字文件，没用；换成TCP端口8891还是不行，求大佬帮忙排查！

系统状态 #

先确认OpenDKIM是正常运行的，执行systemctl status opendkim输出如下：

opendkim.service - OpenDKIM DomainKeys Identified Mail (DKIM) Milter
Loaded: loaded (/lib/systemd/system/opendkim.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2024-02-08 15:57:47 CET; 13min ago
Docs: man:opendkim(8)
      man:opendkim.conf(5)
      man:opendkim-genkey(8)
      man:opendkim-genzone(8)
      man:opendkim-testadsp(8)
      man:opendkim-testkey
      http://www.opendkim.org/docs.html
Process: 41753 ExecStart=/usr/sbin/opendkim -x /etc/opendkim.conf (code=exited, status=0/SUCCESS)
Main PID: 41761 (opendkim)
Tasks: 7 (limit: 19123)
Memory: 5.2M
CGroup: /system.slice/opendkim.service
└─41761 /usr/sbin/opendkim -x /etc/opendkim.conf

Feb 08 15:57:47 vmi995035.contaboserver.net systemd[1]: Starting OpenDKIM DomainKeys Identified Mail (DKIM) Milter...
Feb 08 15:57:47 vmi995035.contaboserver.net systemd[1]: Started OpenDKIM DomainKeys Identified Mail (DKIM) Milter.
Feb 08 15:57:47 vmi995035.contaboserver.net opendkim[41761]: OpenDKIM Filter v2.11.0 starting (args: -x /etc/opendkim.conf)
Feb 08 15:58:05 vmi995035.contaboserver.net opendkim[41761]: E6F8BA010E6: s=verifier201208 d=port25.com a=rsa-sha256 SSL

关键配置文件 #

/etc/opendkim.conf

Syslog                  yes
UMask                   007
Canonicalization        relaxed/simple
Mode                    sv
SubDomains              no
Socket                  inet:8891@localhost
PidFile               /run/opendkim/opendkim.pid
OversignHeaders         From
UserID                opendkim
KeyTable refile:/etc/opendkim/key.table
SigningTable refile:/etc/opendkim/signing.table
ExternalIgnoreList /etc/opendkim/trusted.hosts
InternalHosts /etc/opendkim/trusted.hosts

/etc/opendkim/key.table

default._domainkey.fluffyksa.com fluffyksa.com:default:/etc/opendkim/keys/fluffyksa.com/default.private

/etc/opendkim/signing.table

我试过*@fluffyksa.com和@fluffyksa.com两种写法，都没用：

*@fluffyksa.com    default._domainkey.fluffyksa.com

/etc/default/opendkim

RUNDIR=/run/opendkim
SOCKET="inet:8891@localhost"
USER=opendkim
GROUP=opendkim
PIDFILE=$RUNDIR/$NAME.pid
EXTRAAFTER=

Postfix Milter配置（/etc/postfix/main.cf）

# Milter configuration
milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891

完整Postfix main.cf

myhostname = vmi995035.contaboserver.net
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no
append_dot_mydomain = no
readme_directory = no
compatibility_level = 2

#Enable TLS Encryption when Postfix receives incoming emails
smtpd_tls_cert_file=/etc/letsencrypt/live/mail.fluffyksa.com/fullchain.pem
smtpd_tls_key_file=/etc/letsencrypt/live/mail.fluffyksa.com/privkey.pem
smtpd_tls_security_level=may
smtpd_tls_loglevel = 1
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache

#Enforce TLSv1.3 or TLSv1.2
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination

#alias_maps = hash:/etc/aliases
#alias_database = hash:/etc/aliases

myorigin = /etc/mailname
mydestination = $myhostname, localhost.$mydomain, localhost
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = ipv4
message_size_limit = 52428800

smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_local_domain =
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_sasl_auth_enable = yes

smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination

smtp_tls_note_starttls_offer = yes
smtpd_tls_received_header = yes
mailbox_transport = lmtp:unix:private/dovecot-lmtp
smtputf8_enable = no

virtual_mailbox_domains = proxy:mysql:/etc/postfix/sql/mysql_virtual_domains_maps.cf
virtual_mailbox_maps =
proxy:mysql:/etc/postfix/sql/mysql_virtual_mailbox_maps.cf,
proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_mailbox_maps.cf

virtual_alias_maps =
proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf,
proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_maps.cf,
proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_catchall_maps.cf

virtual_transport = lmtp:unix:private/dovecot-lmtp
virtual_mailbox_base = /var/vmail
virtual_minimum_uid = 2000
virtual_uid_maps = static:2000
virtual_gid_maps = static:2000

policyd-spf_time_limit = 3600

smtpd_recipient_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination,
check_policy_service unix:private/policyd-spf

注意：main.cf里有重复的smtpd_recipient_restrictions配置，日志里会报警告

/etc/opendkim/trusted.hosts

127.0.0.1
localhost
vmi995035.contaboserver.net
mail.fluffyksa.com
*.fluffyksa.com
fluffyksa.com

测试结果 #

1. DKIM密钥测试：执行opendkim-testkey -d fluffyksa.com -s default -vvv输出：

opendkim-testkey: using default configfile /etc/opendkim.conf
opendkim-testkey: checking key 'default._domainkey.fluffyksa.com'
opendkim-testkey: key not secure
opendkim-testkey: key OK

2. 发送测试邮件到check-auth@verifier.port25.com，返回结果：

==========================================================
Summary of Results #

SPF check: pass
"iprev" check: pass
DKIM check: none

3. 查看mail.log里的DKIM相关记录：

Feb  8 15:58:05 vmi995035 opendkim[41761]: E6F8BA010E6: s=verifier201208 d=port25.com a=rsa-sha256 SSL

更新1：发送测试邮件后的mail.log #

用Thunderbird从amir.haroun@fluffyksa.com发送到amireix50@gmail.com，mail.log输出：

Feb  8 17:33:23 vmi995035 postfix/smtpd[46943]: connect from unknown[41.69.213.148]
Feb  8 17:33:24 vmi995035 postfix/smtpd[46943]: Anonymous TLS connection established from unknown[41.69.213.148]: TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
Feb  8 17:33:24 vmi995035 dovecot: auth: Debug: auth client connected (pid=0)
Feb  8 17:33:24 vmi995035 dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=smtp#011nologin#011lip=173.249.3.187#011rip=41.69.213.148#011secured#011resp=AGFtaXIuaGFyb3VuQGZsdWZmeWtzYS5jb20AV2ViaXRhbGxAbWUyMDEy (previous base64 data may contain sensitive data)
Feb  8 17:33:24 vmi995035 dovecot: auth: Debug: sql(amir.haroun@fluffyksa.com,41.69.213.148): Performing passdb lookup
Feb  8 17:33:24 vmi995035 dovecot: auth-worker(5823): Debug: conn unix:auth-worker (pid=5818,uid=115): auth-worker<8646>: Handling PASSV request
Feb  8 17:33:24 vmi995035 dovecot: auth-worker(5823): Debug: sql(amir.haroun@fluffyksa.com,41.69.213.148): Performing passdb lookup
Feb  8 17:33:24 vmi995035 dovecot: auth-worker(5823): Debug: sql(amir.haroun@fluffyksa.com,41.69.213.148): query: SELECT username AS user,password FROM mailbox WHERE username = 'amir.haroun@fluffyksa.com' AND active='1'
Feb  8 17:33:24 vmi995035 dovecot: auth-worker(5823): Debug: sql(amir.haroun@fluffyksa.com,41.69.213.148): Finished passdb lookup
Feb  8 17:33:24 vmi995035 dovecot: auth-worker(5823): Debug: conn unix:auth-worker (pid=5818,uid=115): auth-worker<8646>: Finished
Feb  8 17:33:24 vmi995035 dovecot: auth: Debug: sql(amir.haroun@fluffyksa.com,41.69.213.148): Finished passdb lookup
Feb  8 17:33:24 vmi995035 dovecot: auth: Debug: auth(amir.haroun@fluffyksa.com,41.69.213.148): Auth request finished
Feb  8 17:33:24 vmi995035 dovecot: auth: Debug: client passdb out: OK#0111#011user=amir.haroun@fluffyksa.com#011
Feb  8 17:33:24 vmi995035 postfix/trivial-rewrite[46946]: warning: /etc/postfix/main.cf, line 97: overriding earlier entry: smtpd_recipient_restrictions=permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
Feb  8 17:33:24 vmi995035 postfix/cleanup[46947]: warning: /etc/postfix/main.cf, line 97: overriding earlier entry: smtpd_recipient_restrictions=permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
Feb  8 17:33:24 vmi995035 postfix/smtpd[46943]: D28B7A010E6: client=unknown[41.69.213.148], sasl_method=PLAIN, sasl_username=amir.haroun@fluffyksa.com
Feb  8 17:33:25 vmi995035 postfix/cleanup[46947]: D28B7A010E6: message-id=<7f12ab81-9f1a-46ec-8137-e3703b04daed@fluffyksa.com>
Feb  8 17:33:25 vmi995035 postfix/qmgr[45631]: D28B7A010E6: from=<amir.haroun@fluffyksa.com>, size=756, nrcpt=1 (queue active)
Feb  8 17:33:25 vmi995035 postfix/smtp[46948]: warning: /etc/postfix/main.cf, line 97: overriding earlier entry: smtpd_recipient_restrictions=permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
Feb  8 17:33:25 vmi995035 postfix/smtp[46948]: Untrusted TLS connection established to gmail-smtp-in.l.google.com[64.233.166.27]:25: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256)
Feb  8 17:33:25 vmi995035 dovecot: auth: Debug: auth client connected (pid=46949)
Feb  8 17:33:25 vmi995035 dovecot: auth: Debug: client passdb out: FAIL#0112#011user=newsletter@contaboserver.net
Feb  8 17:33:25 vmi995035 postfix/smtpd[46937]: warning: unknown[45.129.14.179]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Feb  8 17:3