Outbound Webmail Messages Not DKIM Signed - Carbonio CE 4.25.2_ZEXTRAS_202603

@silencio

I set up a CE and did the same minimal steps you describe: generated the domain key with zmdkimkeyutil and published the DNS record. After that one step, Webmail mail signed correctly.

The thing worth noting: on that install the [127.0.0.1]:10025 reinjection also has an empty smtpd_milters, exactly like yours, yet the message is still signed, because the signing happens at an earlier Postfix stage before Amavis. So the empty milter on 10025 is not what blocks signing.

Since you ran the same key generation, the difference is likely in whether that earlier signing stage is active on your server. To compare and understand better, could you please share the outputs of following:

• dpkg -l | grep -E 'carbonio-mta|carbonio-postfix' | awk '{print $2, $3}'
• su - zextras -c "carbonio prov gs $(hostname -f) zimbraServiceEnabled zimbraServiceInstalled" | grep -i opendkim
• su - zextras -c "carbonio prov gs $(hostname -f) zimbraMtaSmtpdMilters zimbraMtaNonSmtpdMilters"
• su - zextras -c "postconf smtpd_milters non_smtpd_milters"
• su - zextras -c "postconf -M" | grep -E ':10025|:10030|dkimmilter'
• su - zextras -c "postconf -P" | grep -i milter
• grep -nE 'dkimmilter|:10030|uncomment SERVICE:opendkim' /opt/zextras/common/conf/master.cf.in

Regards,

@sharif, thanks for taking the interest and the time to check 🙂

Here are the requested outputs from my server.

Ubuntu:

• Ubuntu 22.04 LTS

Packages:

carbonio-mta 4.2.3-1jammy
carbonio-postfix 3.10.5-2jammy

OpenDKIM service registration:

su - zextras -c "carbonio prov gs $(hostname -f) zimbraServiceEnabled zimbraServiceInstalled" | grep -i opendkim

Returns no output.

Milter configuration:

# name hermes.einkaufsring.com
zimbraMtaNonSmtpdMilters: inet:127.0.0.1:8465
zimbraMtaSmtpdMilters: inet:127.0.0.1:8465

Postfix:

smtpd_milters = inet:127.0.0.1:8465, inet:127.0.0.1:7026
non_smtpd_milters = inet:127.0.0.1:8465

Services:

[127.0.0.1]:10025 ... smtpd_milters=inet:127.0.0.1:8465 ...
[127.0.0.1]:10030 ... smtpd_milters=inet:localhost:8465 ...
syslog_name=postfix/dkimmilter
content_filter=smtp:[127.0.0.1]:10025

Per-service milter settings:

465/inet/milter_macro_daemon_name = ORIGINATING
submission/inet/milter_macro_daemon_name = ORIGINATING
[127.0.0.1]:10025/inet/smtpd_milters = inet:127.0.0.1:8465
[127.0.0.1]:10030/inet/smtpd_milters = inet:localhost:8465
[127.0.0.1]:10030/inet/syslog_name = postfix/dkimmilter

master.cf.in:

14:%%uncomment SERVICE:opendkim%%       -o content_filter=scan:[%%zimbraLocalBindAddress%%]:10030
16:%%uncomment SERVICE:opendkim%%       -o content_filter=scan:[%%zimbraLocalBindAddress%%]:10030
29:%%uncomment SERVICE:opendkim%%       -o content_filter=scan:[%%zimbraLocalBindAddress%%]:10030
146:[%%zimbraLocalBindAddress%%]:10030 inet n - n - - smtpd
164:    -o syslog_name=postfix/dkimmilter
169:%%uncomment SERVICE:opendkim%%      -o content_filter=scan:[%%zimbraLocalBindAddress%%]:10030

Additional observation:

Outbound mail from Carbonio Webmail was not DKIM-signed originally.

As a workaround I changed:

 removed link 

10025 service:

- -o smtpd_milters=
+ -o smtpd_milters=inet:127.0.0.1:8465

After regenerating configuration with:

zmmtactl restart

Gmail immediately started reporting:

dkim=pass
spf=pass

and DKIM-Signature headers appeared in outbound mail.

What I do not understand is why the normal 10030 dkimmilter path did not sign messages before this change. Also, opendkim does not appear in zimbraServiceEnabled or zimbraServiceInstalled on this node.

Does that indicate a missing service registration or configuration issue?

@silencio 

Thanks for the detailed output.

It seems like the opendkim service is missing from zimbraServiceEnabled and zimbraServiceInstalled. It explains your first question too. On Carbonio CE, the Postfix template only wires your outbound services (submission and 465) into the DKIM signing stage at port 10030 when opendkim is registered as a service.

Could you please try this:

su - zextras -c 'carbonio prov ms $(hostname -f) +zimbraServiceInstalled opendkim +zimbraServiceEnabled opendkim'
su - zextras -c 'zmconfigdctl restart'
su - zextras -c 'zmmtactl restart'

then check:

su - zextras -c 'postconf -P | grep -E "^(submission|465)/inet/content_filter"'

Regards,

@sharif 

I did the sequence you kindly suggested:

root@hermes ~ # su - zextras -c 'carbonio prov ms $(hostname -f) +zimbraServiceInstalled opendkim +zimbraServiceEnabled opendkim'
root@hermes ~ # su - zextras -c 'zmconfigdctl restart'
Stopping zmconfigd...done.
Starting zmconfigd...done.
root@hermes ~ # su - zextras -c 'zmmtactl restart'
Rewriting configuration files...done.
Stopping milter server...done.
Starting milter server...done.
Stopping saslauthd...done.
Starting saslauthd...done.
/postfix-script: refreshing the Postfix mail system
root@hermes ~ # su - zextras -c 'postconf -P | grep -E "^(submission|465)/inet/content_filter"'
465/inet/content_filter = scan:[127.0.0.1]:10030
submission/inet/content_filter = scan:[127.0.0.1]:10030

and of course you were right, the intended Carbonio DKIM route is active now.So I reverted the workaround that I did, in order to prevent double-spinning:

root@hermes ~ # cp -a /opt/zextras/common/conf/master.cf.in /root/master.cf.in.before-revert-10025-dkim.$(date +%F-%H%M%S)
root@hermes ~ # sed -i '/^\[%%zimbraLocalBindAddress%%\]:10025 /,/^\[%%zimbraLocalBindAddress%%\]:10030 /s|^\([[:space:]]*-o smtpd_milters=\).*|\1|' \
/opt/zextras/common/conf/master.cf.in
root@hermes ~ # su - zextras -c 'zmmtactl restart'
Rewriting configuration files...done.
Stopping milter server...done.
Starting milter server...done.
Stopping saslauthd...done.
Starting saslauthd...done.
/postfix-script: refreshing the Postfix mail system
root@hermes ~ # su - zextras -c 'postconf -P | grep -E "^(submission|465)/inet/content_filter"'
465/inet/content_filter = scan:[127.0.0.1]:10030
submission/inet/content_filter = scan:[127.0.0.1]:10030
root@hermes ~ # su - zextras -c "postconf -P '[127.0.0.1]:10025/inet/smtpd_milters'"
[127.0.0.1]:10025/inet/smtpd_milters =
root@hermes ~ # su - zextras -c "postconf -P '[127.0.0.1]:10030/inet/smtpd_milters'"
[127.0.0.1]:10030/inet/smtpd_milters = inet:localhost:8465

... and I tried to send a test emal. And got a double DKIM signature :))) Until I remembered I had to remove OpenDKIM from the global milter settings and leave Carbonio’s own milter on 7026. So it is clean now and works like a charm. As intended, I should actually say. Thank you very much for the solution - I was dumb enough not to check the services at all to begin with.

What bugs me still - How come it was installed correctly, and never registered the service? If I was to make a "bug report" on it, it would go like this, approximately: "Fresh Carbonio CE installation resulted in OpenDKIM package being installed and operational, but opendkim was missing from zimbraServiceInstalled and zimbraServiceEnabled. As a result, %%uncomment SERVICE:opendkim%% sections in master.cf.in remained inactive, preventing mail submitted via Webmail/submission from entering the DKIM signing path. Manually registering the service with carbonio prov ms <server> +zimbraServiceInstalled opendkim +zimbraServiceEnabled opendkim immediately restored the intended routing and DKIM signing."

This might be reproducible. Is it worth investigating?

Thanks once more, and best regards.