OpenDKIM多子域名批量配置及ESP级自动化方案咨询

Hey there! Let's tackle your OpenDKIM questions step by step, then dig into how large ESPs handle this kind of scale.

1. opendkim.conf 中 Subdomain 参数的设置 #

You absolutely need to set Subdomain yes in /etc/opendkim.conf. This tells OpenDKIM to automatically sign emails from any subdomain of mydomain.com using the main domain's DKIM key (instead of requiring a separate key for each subdomain). Without this setting, OpenDKIM won't recognize subdomains as part of your domain space, which is why your wildcard attempts were failing earlier.

2. Signing Table 的通配符配置 #

Your initial wildcard syntax was off—here's the correct way to match all subdomains (and optionally the main domain):

• To cover all subdomains (e.g., joe@test.mydomain.com, jane@dev.mydomain.com):

  *@*.mydomain.com default._domainkey.mydomain.com.
  

• If you also want to cover the main domain (e.g., bob@mydomain.com), add this line too:

  *@mydomain.com default._domainkey.mydomain.com.
  

This works because the * wildcard matches any local part (before @) and any subdomain. Combined with Subdomain yes, OpenDKIM will use your main domain's DKIM key to sign all these emails—no need to list 50 subdomains individually.

3. Key Table 的正确配置 #

You only need the main domain entry in /etc/opendkim/key.table:

default._domainkey.mydomain.com  mydomain.com:default:/etc/opendkim/keys/mydomain.com/default.private

When Subdomain yes is enabled, OpenDKIM will automatically use this main domain key for all subdomain emails. The reason your first attempt failed earlier was because you hadn't set Subdomain yes—OpenDKIM was expecting a subdomain-specific key entry.

4. 大型ESP如何实现规模化自动化？ #

Mailchimp, SendGrid, and other ESPs don't rely on static OpenDKIM config files like you're using now. Here's how they do it:

• Dynamic Key Generation & Storage:
  • Each client's domain gets a unique DKIM selector (e.g., mailchimp123._domainkey.clientdomain.com) and key pair. These are stored in a database (not the filesystem) for quick lookup.
• Dynamic Configuration Loading:
  • OpenDKIM supports integrating with databases (via LDAP/SQL modules) or custom scripts to fetch signing/key table data on the fly, instead of reading static files. This lets them serve thousands of client domains without manually editing configs.
• DNS Automation:
  • Either:
    1. Provide clients with a pre-generated DKIM TXT record they add to their own DNS (like most ESPs do), or
    2. Use DNS provider APIs to automatically add the DKIM record if the client grants access (less common, but more seamless).
• Multi-Tenant Isolation:
  • Keys are strictly separated per client to prevent cross-domain signing issues. Some ESPs even run separate OpenDKIM instances for different client groups, but database-driven configs are more scalable.
• Bulk Workflows:
  • Use automation scripts (Python/Go/Bash) to handle client onboarding: generate keys, store them in the database, generate DNS instructions, and update any necessary system configs—all without manual intervention.

调试小技巧 #

• Test your DKIM setup with:

  opendkim-testkey -d test.mydomain.com -s default
  

• Check OpenDKIM logs (usually /var/log/opendkim.log or /var/log/mail.log) for detailed error messages if signing fails—this will tell you exactly why a particular email wasn't signed correctly.

备注：内容来源于stack exchange，提问作者Digital Joe George