| blob | 684b95f214a2b1bb0b02151a0f83afd17b922f8a |
1 ##
2 ## opendkim.conf -- configuration file for OpenDKIM filter
3 ##
4 ## Copyright (c) 2010-2015, The Trusted Domain Project. All rights reserved.
5 ##
7 ##
8 ## For settings that refer to a "dataset", see the opendkim(8) man page.
9 ##
11 ## DEPRECATED CONFIGURATION OPTIONS
12 ##
13 ## The following configuration options are no longer valid. They should be
14 ## removed from your existing configuration file to prevent potential issues.
15 ## Failure to do so may result in opendkim being unable to start.
16 ##
17 ## Removed in 2.10.0:
18 ## AddAllSignatureResults
19 ## ADSPAction
20 ## ADSPNoSuchDomain
21 ## BogusPolicy
22 ## DisableADSP
23 ## LDAPSoftStart
24 ## LocalADSP
25 ## NoDiscardableMailTo
26 ## On-PolicyError
27 ## SendADSPReports
28 ## UnprotectedPolicy
30 ## CONFIGURATION OPTIONS
32 ## AllowSHA1Only { yes | no }
33 ## default "no"
34 ##
35 ## By default, the filter will refuse to start if support for SHA256 is
36 ## not available since this violates the strong recommendations of
37 ## RFC6376 Section 3.3, which says:
38 ##
39 ## "Verifiers MUST implement both rsa-sha1 and rsa-sha256. Signers MUST
40 ## implement and SHOULD sign using rsa-sha256."
41 ##
42 ## This forces that violation to be explicitly selected by the administrator.
44 # AllowSHA1Only no
46 ## AlwaysAddARHeader { yes | no }
47 ## default "no"
48 ##
49 ## Add an "Authentication-Results:" header even to unsigned messages
50 ## from domains with no "signs all" policy. The reported DKIM result
51 ## will be "none" in such cases. Normally unsigned mail from non-strict
52 ## domains does not cause the results header to be added.
54 # AlwaysAddARHeader no
56 ## AuthservID string
57 ## default (local host name)
58 ##
59 ## Defines the "authserv-id" token to be used when generating
60 ## Authentication-Results headers after message verification.
62 # AuthservID example.com
64 ## AuthservIDWithJobID
65 ## default "no"
66 ##
67 ## Appends a "/" followed by the MTA's job ID to the "authserv-id" token
68 ## when generating Authentication-Results headers after message verification.
70 # AuthservIDWithJobId no
72 ## AutoRestart { yes | no }
73 ## default "no"
74 ##
75 ## Indicate whether or not the filter should arrange to restart automatically
76 ## if it crashes.
78 # AutoRestart No
80 ## AutoRestartCount n
81 ## default 0
82 ##
83 ## Sets the maximum automatic restart count. After this number of
84 ## automatic restarts, the filter will give up and terminate. A value of 0
85 ## implies no limit.
87 # AutoRestartCount 0
89 ## AutoRestartRate n/t[u]
90 ## default (none)
91 ##
92 ## Sets the maximum automatic restart rate. See the opendkim.conf(5)
93 ## man page for the format of this parameter.
95 # AutoRestartRate n/tu
97 ## Background { yes | no }
98 ## default "yes"
99 ##
100 ## Indicate whether or not the filter should run in the background.
102 # Background Yes
104 ## BaseDirectory path
105 ## default (none)
106 ##
107 ## Causes the filter to change to the named directory before beginning
108 ## operation. Thus, cores will be dumped here and configuration files
109 ## are read relative to this location.
111 # BaseDirectory /var/run/opendkim
113 ## BodyLengthDB dataset
114 ## default (none)
115 ##
116 ## A data set that is checked against envelope recipients to see if a
117 ## body length tag should be included in the generated signature.
118 ## This has security implications; see opendkim.conf(5) for details.
120 # BodyLengthDB dataset
122 ## Canonicalization hdrcanon[/bodycanon]
123 ## default "simple/simple"
124 ##
125 ## Select canonicalizations to use when signing. If the "bodycanon" is
126 ## omitted, "simple" is used. Valid values for each are "simple" and
127 ## "relaxed".
129 # Canonicalization simple/simple
131 ## ClockDrift n
132 ## default 300
133 ##
134 ## Specify the tolerance range for expired signatures or signatures
135 ## which appear to have timestamps in the future, allowing for clock
136 ## drift.
138 # ClockDrift 300
140 ## Diagnostics { yes | no }
141 ## default "no"
142 ##
143 ## Specifies whether or not signatures with header diagnostic tags should
144 ## be generated.
146 # Diagnostics No
148 ## DNSTimeout n
149 ## default 10
150 ##
151 ## Specify the time in seconds to wait for replies from the nameserver when
152 ## requesting keys or signing policies.
154 # DNSTimeout 10
156 ## Domain dataset
157 ## default (none)
158 ##
159 ## Specify for which domain(s) signing should be done. No default; must
160 ## be specified for signing.
162 Domain example.com
164 ## DomainKeysCompat { yes | no }
165 ## default "no"
166 ##
167 ## When enabled, backward compatibility with DomainKeys (RFC4870) key
168 ## records is enabled. Otherwise, such key records are considered to be
169 ## syntactically invalid.
171 # DomainKeysCompat no
173 ## DontSignMailTo dataset
174 ## default (none)
175 ##
176 ## Gives a list of recipient addresses or address patterns whose mail should
177 ## not be signed.
179 # DontSignMailTo addr1,addr2,...
181 ## EnableCoredumps { yes | no }
182 ## default "no"
183 ##
184 ## On systems which have support for such, requests that the kernel dump
185 ## core even though the process may change user ID during its execution.
187 # EnableCoredumps no
189 ## ExemptDomains dataset
190 ## default (none)
191 ##
192 ## A data set of domain names that are checked against the message sender's
193 ## domain. If a match is found, the message is ignored by the filter.
195 # ExemptDomains domain1,domain2,...
197 ## ExternalIgnoreList filename
198 ##
199 ## Names a file from which a list of externally-trusted hosts is read.
200 ## These are hosts which are allowed to send mail through you for signing.
201 ## Automatically contains 127.0.0.1. See man page for file format.
203 # ExternalIgnoreList filename
205 ## FixCRLF { yes | no }
206 ##
207 ## Requests that the library convert "naked" CR and LF characters to
208 ## CRLFs during canonicalization. The default is "no".
210 # FixCRLF no
212 ## IgnoreMalformedMail { yes | no }
213 ## default "no"
214 ##
215 ## Silently passes malformed messages without alteration. This includes
216 ## messages that fail the RequiredHeaders check, if enabled. The default is
217 ## to pass those messages but add an Authentication-Results field indicating
218 ## that they were malformed.
220 # IgnoreMalformedMail no
222 ## InternalHosts dataset
223 ## default "127.0.0.1"
224 ##
225 ## Names a file from which a list of internal hosts is read. These are
226 ## hosts from which mail should be signed rather than verified.
227 ## Automatically contains 127.0.0.1.
229 # InternalHosts dataset
231 ## KeepTemporaryFiles { yes | no }
232 ## default "no"
233 ##
234 ## If set, causes temporary files generated during message signing or
235 ## verifying to be left behind for debugging use. Not for normal operation;
236 ## can fill your disks quite fast on busy systems.
238 # KeepTemporaryFiles no
240 ## KeyFile filename
241 ## default (none)
242 ##
243 ## Specifies the path to the private key to use when signing. Ignored if
244 ## SigningTable and KeyTable are used. No default; must be specified for
245 ## signing if SigningTable/KeyTable are not in use.
247 KeyFile /var/db/dkim/example.private
249 ## KeyTable dataset
250 ## default (none)
251 ##
252 ## Defines a table that will be queried to convert key names to
253 ## sets of data of the form (signing domain, signing selector, private key).
254 ## The private key can either contain a PEM-formatted private key,
255 ## a base64-encoded DER format private key, or a path to a file containing
256 ## one of those.
258 # KeyTable dataset
260 ## LogWhy { yes | no }
261 ## default "no"
262 ##
263 ## If logging is enabled (see Syslog below), issues very detailed logging
264 ## about the logic behind the filter's decision to either sign a message
265 ## or verify it. The logic behind the decision is non-trivial and can be
266 ## confusing to administrators not familiar with its operation. A
267 ## description of how the decision is made can be found in the OPERATIONS
268 ## section of the opendkim(8) man page. This causes a large increase
269 ## in the amount of log data generated for each message, so it should be
270 ## limited to debugging use and not enabled for general operation.
272 # LogWhy no
274 ## MacroList macro[=value][,...]
275 ##
276 ## Gives a set of MTA-provided macros which should be checked to see
277 ## if the sender has been determined to be a local user and therefore
278 ## whether or not signing should be done. See opendkim.conf(5) for
279 ## more information.
281 # MacroList foo=bar,baz=blivit
283 ## MaximumHeaders n
284 ##
285 ## Disallow messages whose header blocks are bigger than "n" bytes.
286 ## Intended to detect and block a denial-of-service attack. The default
287 ## is 65536. A value of 0 disables this test.
289 # MaximumHeaders n
291 ## MaximumSignaturesToVerify n
292 ## (default 3)
293 ##
294 ## Verify no more than "n" signatures on an arriving message.
295 ## A value of 0 means "no limit".
297 # MaximumSignaturesToVerify n
299 ## MaximumSignedBytes n
300 ##
301 ## Don't sign more than "n" bytes of the message. The default is to
302 ## sign the entire message. Setting this implies "BodyLengths".
304 # MaximumSignedBytes n
306 ## MilterDebug n
307 ##
308 ## Request a debug level of "n" from the milter library. The default is 0.
310 # MilterDebug 0
312 ## Minimum n[% | +]
313 ## default 0
314 ##
315 ## Sets a minimum signing volume; one of the following formats:
316 ## n at least n bytes (or the whole message, whichever is less)
317 ## must be signed
318 ## n% at least n% of the message must be signed
319 ## n+ if a length limit was presented in the signature, no more than
320 ## n bytes may have been added
322 # Minimum n
324 ## MinimumKeyBits n
325 ## default 1024
326 ##
327 ## Causes the library not to accept signatures matching keys made of fewer
328 ## than the specified number of bits, even if they would otherwise pass
329 ## DKIM signing.
331 # MinimumKeyBits 1024
333 ## Mode [sv]
334 ## default sv
335 ##
336 ## Indicates which mode(s) of operation should be provided. "s" means
337 ## "sign", "v" means "verify".
339 # Mode sv
341 ## MTA dataset
342 ## default (none)
343 ##
344 ## Specifies a list of MTAs whos mail should always be signed rather than
345 ## verified. The "mtaname" is extracted from the DaemonPortOptions line
346 ## in effect.
348 # MTA name
350 ## MultipleSignatures { yes | no }
351 ## default no
352 ##
353 ## Allows multiple signatures to be added. If set to "true" and a SigningTable
354 ## is in use, all SigningTable entries that match the candidate message will
355 ## cause a signature to be added. Otherwise, only the first matching
356 ## SigningTable entry will be added, or only the key defined by Domain,
357 ## Selector and KeyFile will be added.
359 # MultipleSignatures no
361 ## MustBeSigned dataset
362 ## default (none)
363 ##
364 ## Defines a list of headers which, if present on a message, must be
365 ## signed for the signature to be considered acceptable.
367 # MustBeSigned header1,header2,...
369 ## Nameservers addr1[,addr2[,...]]
370 ## default (none)
371 ##
372 ## Provides a comma-separated list of IP addresses that are to be used when
373 ## doing DNS queries to retrieve DKIM keys, VBR records, etc.
374 ## These override any local defaults built in to the resolver in use, which
375 ## may be defined in /etc/resolv.conf or hard-coded into the software.
377 # Nameservers addr1,addr2,...
379 ## NoHeaderB { yes | no }
380 ## default "no"
381 ##
382 ## Suppresses addition of "header.b" tags on Authentication-Results
383 ## header fields.
385 # NoHeaderB no
387 ## OmitHeaders dataset
388 ## default (none)
389 ##
390 ## Specifies a list of headers that should always be omitted when signing.
391 ## Header names should be separated by commas.
393 # OmitHeaders header1,header2,...
395 ## On-...
396 ##
397 ## Specifies what to do when certain error conditions are encountered.
398 ##
399 ## See opendkim.conf(5) for more information.
401 # On-Default
402 # On-BadSignature
403 # On-DNSError
404 # On-InternalError
405 # On-NoSignature
406 # On-Security
407 # On-SignatureError
409 ## OversignHeaders dataset
410 ## default (none)
411 ##
412 ## Specifies a set of header fields that should be included in all signature
413 ## header lists (the "h=" tag) once more than the number of times they were
414 ## actually present in the signed message. See opendkim.conf(5) for more
415 ## information.
417 # OverSignHeaders header1,header2,...
419 ## PeerList dataset
420 ## default (none)
421 ##
422 ## Contains a list of IP addresses, CIDR blocks, hostnames or domain names
423 ## whose mail should be neither signed nor verified by this filter. See man
424 ## page for file format.
426 # PeerList filename
428 ## PidFile filename
429 ## default (none)
430 ##
431 ## Name of the file where the filter should write its pid before beginning
432 ## normal operations.
434 # PidFile filename
436 ## POPDBFile dataset
437 ## default (none)
438 ##
439 ## Names a database which should be checked for "POP before SMTP" records
440 ## as a form of authentication of users who may be sending mail through
441 ## the MTA for signing. Requires special compilation of the filter.
442 ## See opendkim.conf(5) for more information.
444 # POPDBFile filename
446 ## Quarantine { yes | no }
447 ## default "no"
448 ##
449 ## Indicates whether or not the filter should arrange to quarantine mail
450 ## which fails verification. Intended for diagnostic use only.
452 # Quarantine No
454 ## QueryCache { yes | no }
455 ## default "no"
456 ##
457 ## Instructs the DKIM library to maintain its own local cache of keys and
458 ## policies retrieved from DNS, rather than relying on the nameserver for
459 ## caching service. Useful if the nameserver being used by the filter is
460 ## not local. The filter must be compiled with the QUERY_CACHE flag to enable
461 ## this feature, since it adds a library dependency.
463 # QueryCache No
465 ## RedirectFailuresTo address
466 ## default (none)
467 ##
468 ## Redirects signed messages to the specified address if none of the
469 ## signatures present failed to verify.
471 # RedirectFailuresTo postmaster@example.com
473 ## RemoveARAll { yes | no }
474 ## default "no"
475 ##
476 ## Remove all Authentication-Results: headers on all arriving mail.
478 # RemoveARAll No
480 ## RemoveARFrom dataset
481 ## default (none)
482 ##
483 ## Remove all Authentication-Results: headers on all arriving mail that
484 ## claim to have been added by hosts listed in this parameter. The list
485 ## should be comma-separated. Entire domains may be specified by preceding
486 ## the dopmain name by a single dot (".") character.
488 # RemoveARFrom host1,host2,.domain1,.domain2,...
490 ## RemoveOldSignatures { yes | no }
491 ## default "no"
492 ##
493 ## Remove old signatures on messages, if any, when generating a signature.
495 # RemoveOldSignatures No
497 ## ReportAddress addr
498 ## default (executing user)@(hostname)
499 ##
500 ## Specifies the sending address to be used on From: headers of outgoing
501 ## failure reports. By default, the e-mail address of the user executing
502 ## the filter is used.
504 # ReportAddress "DKIM Error Postmaster" <postmaster@example.com>
506 ## ReportBccAddress addr
507 ## default (none)
508 ##
509 ## Specifies additional recipient address(es) to receive outgoing failure
510 ## reports.
512 # ReportBccAddress postmaster@example.com, john@example.com
514 ## RequiredHeaders { yes | no }
515 ## default no
516 ##
517 ## Rejects messages which don't conform to RFC5322 header count requirements.
519 # RequiredHeaders No
521 ## RequireSafeKeys { yes | no }
522 ## default yes
523 ##
524 ## Refuses to use key files that appear to have unsafe permissions.
526 # RequireSafeKeys Yes
528 ## ResignAll { yes | no }
529 ## default no
530 ##
531 ## Where ResignMailTo triggers a re-signing action, this flag indicates
532 ## whether or not all mail should be signed (if set) versus only verified
533 ## mail being signed (if not set).
535 # ResignAll No
537 ## ResignMailTo dataset
538 ## default (none)
539 ##
540 ## Checks each message recipient against the specified dataset for a
541 ## matching record. The full address is checked in each case, then the
542 ## hostname, then each domain preceded by ".". If there is a match, the
543 ## value returned is presumed to be the name of a key in the KeyTable
544 ## (if defined) to be used to re-sign the message in addition to
545 ## verifying it. If there is a match without a KeyTable, the default key
546 ## is applied.
548 # ResignMailTo dataset
550 ## ResolverConfiguration string
551 ##
552 ## Passes arbitrary configuration data to the resolver. For the stock UNIX
553 ## resolver, this is ignored; for Unbound, it names a resolv.conf(5)-style
554 ## file that should be read for configuration information.
556 # ResolverConfiguration string
558 ## ResolverTracing { yes | no }
559 ##
560 ## Requests enabling of resolver trace features, if available. The effect
561 ## of setting this flag depends on how trace features, if any, are implemented
562 ## in the resolver in use. Currently only effective when used with the
563 ## OpenDKIM asynchronous resolver.
565 # ResolverTracing no
567 ## Selector name
568 ##
569 ## The name of the selector to use when signing. No default; must be
570 ## specified for signing.
572 Selector my-selector-name
574 ## SenderHeaders dataset
575 ## default (none)
576 ##
577 ## Overrides the default list of headers that will be used to determine
578 ## the sending domain when deciding whether to sign the message and with
579 ## with which key(s). See opendkim.conf(5) for details.
581 # SenderHeaders From
583 ## SendReports { yes | no }
584 ## default "no"
585 ##
586 ## Specifies whether or not the filter should generate report mail back
587 ## to senders when verification fails and an address for such a purpose
588 ## is provided. See opendkim.conf(5) for details.
590 # SendReports No
592 ## SignatureAlgorithm signalg
593 ## default "rsa-sha256"
594 ##
595 ## Signature algorithm to use when generating signatures. Must be either
596 ## "rsa-sha1" or "rsa-sha256".
598 # SignatureAlgorithm rsa-sha256
600 ## SignatureTTL seconds
601 ## default "0"
602 ##
603 ## Specifies the lifetime in seconds of signatures generated by the
604 ## filter. A value of 0 means no expiration time is included in the
605 ## signature.
607 # SignatureTTL 0
609 ## SignHeaders dataset
610 ## default (none)
611 ##
612 ## Specifies the list of headers which should be included when generating
613 ## signatures. The string should be a comma-separated list of header names.
614 ## See the opendkim.conf(5) man page for more information.
616 # SignHeaders header1,header2,...
618 ## SigningTable dataset
619 ## default (none)
620 ##
621 ## Defines a dataset that will be queried for the message sender's address
622 ## to determine which private key(s) (if any) should be used to sign the
623 ## message. The sender is determined from the value of the sender
624 ## header fields as described with SenderHeaders above. The key for this
625 ## lookup should be an address or address pattern that matches senders;
626 ## see the opendkim.conf(5) man page for more information. The value
627 ## of the lookup should return the name of a key found in the KeyTable
628 ## that should be used to sign the message. If MultipleSignatures
629 ## is set, all possible lookup keys will be attempted which may result
630 ## in multiple signatures being applied.
632 # SigningTable filename
634 ## SingleAuthResult { yes | no}
635 ## default "no"
636 ##
637 ## When DomainKeys verification is enabled, multiple Authentication-Results
638 ## will be added, one for DK and one for DKIM. With this enabled, only
639 ## a DKIM result will be reported unless DKIM failed but DK passed, in which
640 ## case only a DK result will be reported.
642 # SingleAuthResult no
644 ## SMTPURI uri
645 ##
646 ## Specifies a URI (e.g., "smtp://localhost") to which mail should be sent
647 ## via SMTP when notifications are generated.
649 # Socket smtp://localhost
651 ## Socket socketspec
652 ##
653 ## Names the socket where this filter should listen for milter connections
654 ## from the MTA. Required. Should be in one of these forms:
655 ##
656 ## inet:port@address to listen on a specific interface
657 ## inet:port to listen on all interfaces
658 ## local:/path/to/socket to listen on a UNIX domain socket
660 Socket inet:port@localhost
662 ## SoftwareHeader { yes | no }
663 ## default "no"
664 ##
665 ## Add a DKIM-Filter header field to messages passing through this filter
666 ## to identify messages it has processed.
668 # SoftwareHeader no
670 ## StrictHeaders { yes | no }
671 ## default "no"
672 ##
673 ## Requests that the DKIM library refuse to process a message whose
674 ## header fields do not conform to the standards, in particular Section 3.6
675 ## of RFC5322.
677 # StrictHeaders no
679 ## StrictTestMode { yes | no }
680 ## default "no"
681 ##
682 ## Selects strict CRLF mode during testing (see the "-t" command line
683 ## flag in the opendkim(8) man page). Messages for which all header
684 ## fields and body lines are not CRLF-terminated are considered malformed
685 ## and will produce an error.
687 # StrictTestMode no
689 ## SubDomains { yes | no }
690 ## default "no"
691 ##
692 ## Sign for subdomains as well?
694 # SubDomains No
696 ## Syslog { yes | no }
697 ## default "yes"
698 ##
699 ## Log informational and error activity to syslog?
701 Syslog Yes
703 ## SyslogFacility facility
704 ## default "mail"
705 ##
706 ## Valid values are :
707 ## auth cron daemon kern lpr mail news security syslog user uucp
708 ## local0 local1 local2 local3 local4 local5 local6 local7
709 ##
710 ## syslog facility to be used
712 # SyslogFacility mail
714 ## SyslogSuccess { yes | no }
715 ## default "no"
716 ##
717 ## Log success activity to syslog?
719 # SyslogSuccess No
721 ## TemporaryDirectory path
722 ## default /tmp
723 ##
724 ## Specifies which directory will be used for creating temporary files
725 ## during message processing.
727 # TemporaryDirectory /tmp
729 ## TestPublicKeys filename
730 ## default (none)
731 ##
732 ## Names a file from which public keys should be read. Intended for use
733 ## only during automated testing.
735 # TestPublicKeys /tmp/testkeys
737 ## TrustAnchorFile filename
738 ## default (none)
739 ##
740 ## Specifies a file from which trust anchor data should be read when doing
741 ## DNS queries and applying the DNSSEC protocol. See the Unbound documentation
742 ## at http://unbound.net for the expected format of this file.
744 # TrustAnchorFile /var/named/trustanchor
746 ## UMask mask
747 ## default (none)
748 ##
749 ## Change the process umask for file creation to the specified value.
750 ## The system has its own default which will be used (usually 022).
751 ## See the umask(2) man page for more information.
753 # UMask 022
755 # UnboundConfigFile /var/named/unbound.conf
757 ## Userid userid
758 ## default (none)
759 ##
760 ## Change to user "userid" before starting normal operation? May include
761 ## a group ID as well, separated from the userid by a colon.
763 # UserID userid