How to Configure DKIM with Postfix on Ubuntu

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outbound emails. Receiving servers verify this signature to confirm the email genuinely came from your domain.

Step 1 — Install OpenDKIM

sudo apt install opendkim opendkim-tools -y

Step 2 — Generate DKIM Keys

sudo mkdir -p /etc/opendkim/keys/yourdomain.com
sudo opendkim-genkey -b 2048 -d yourdomain.com -D /etc/opendkim/keys/yourdomain.com -s mail -v
sudo chown opendkim:opendkim /etc/opendkim/keys/yourdomain.com/mail.private

Step 3 — Configure OpenDKIM

sudo nano /etc/opendkim.conf

Syslog          yes
SyslogSuccess   yes
LogWhy          yes
Canonicalization relaxed/simple
Domain          yourdomain.com
Selector        mail
KeyFile         /etc/opendkim/keys/yourdomain.com/mail.private
Socket          inet:8891@localhost
RequireSafeKeys false

Step 4 — Connect Postfix to OpenDKIM

sudo nano /etc/postfix/main.cf

milter_protocol = 6
milter_default_action = accept
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891

Step 5 — Add DNS TXT Record

# Get your public key
sudo cat /etc/opendkim/keys/yourdomain.com/mail.txt

Add to DNS:

mail._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=YOUR_PUBLIC_KEY"

Step 6 — Restart and Test

sudo systemctl restart opendkim postfix

# Send test email and verify DKIM header
# Check at: https://www.mail-tester.com

Verify DKIM is Working

# Check DNS propagation
dig TXT mail._domainkey.yourdomain.com

# Verify signature in received email headers
# Look for: DKIM-Signature: v=1; a=rsa-sha256

Conclusion

DKIM signing significantly improves email deliverability. Our team configures complete email authentication — SPF, DKIM and DMARC together.