docs: Rspamd DKIM config simplify via `path` setting #3702

denisix · 2023-12-16T11:23:39Z

using DKIM signing in Rspamd - automatically match keys for domains in dkim_signing.conf

Description

in dkim_signing.conf added configuration lines to automatically match domain keys instead of manually adding config for each domain that configured in DMS

Type of change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Improvement (non-breaking change that does improve existing functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
This change requires a documentation update

Checklist:

My code follows the style guidelines of this project
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation (README.md or the documentation under docs/)
If necessary I have added tests that prove my fix is effective or that my feature works
New and existing unit tests pass locally with my changes
I have added information about changes made in this PR to CHANGELOG.md

using DKIM signing in Rspamd - automatically match keys for domains in dkim_signing.conf

polarathene

Nice improvement thanks!

polarathene · 2023-12-16T21:22:24Z

docs/content/config/best-practices/dkim_dmarc_spf.md

+        selector = "mail";
+        path = "/tmp/docker-mailserver/opendkim/keys/$domain/$selector.private"; # this will automatically match keys for domains


~~Can you please cite the source for this feature?~~ (EDIT: Not necessary, cited below)

I see on the rspamd dkim docs that selector is used as the default with the $selector variable, ~~but $domain is only mentioned in a comment, is that also a fixed fallback value or is it documented somewhere as dynamic?~~

EDIT: After reading the first section and going over the config example / defaults, I see that $domain is from use_domain setting, which defaults to dynamically sourced from header but could be configured as a fixed domain. While selector defaults to dkim.

This context with source citing is now also part of the related TODO issue: #3778

docs/content/config/best-practices/dkim_dmarc_spf.md

polarathene · 2023-12-16T21:37:27Z

docs/content/config/best-practices/dkim_dmarc_spf.md

+        selector = "mail";
+        path = "/tmp/docker-mailserver/opendkim/keys/$domain/$selector.private"; # this will automatically match keys for domains
+
+        # domain specific configurations can be provided below:


Alternatively there is a simple selector_map setting that references a file of $domain $selector pairs per line.

The $domain is used to lookup the $selector override (if any), similar to how the config here works. Assuming selector_maps is compatible with multiple selectors as well, then the only difference from this config below is configuring different path which we don't really need, and a similar setting path_maps supports.

This feedback has been migrated to a separate TODO issue: #3778

polarathene · 2023-12-17T20:18:43Z

Worth noting perhaps, the default for $domain in the config has eSLD normalization enabled, which means some configurations (like [email protected]) won't have a valid direct match (normalizes $domain to example.com).

I think that applies regardless of config approach. Just mentioning for maintainers to be aware of if that ever comes up as a reported problem in future 😅

georglauterbach · 2023-12-19T08:38:10Z

Worth noting perhaps, the default for $domain in the config has eSLD normalization enabled, which means some configurations (like [email protected]) won't have a valid direct match (normalizes $domain to example.com).

I think that applies regardless of config approach. Just mentioning for maintainers to be aware of if that ever comes up as a reported problem in future 😅

This can probably be configured with use_esld = true;?

polarathene · 2023-12-19T21:13:36Z

This can probably be configured with use_esld = true;?

Yes, just raising awareness about it since it may show up some day as a bug report. If it does it's a simple documentation fix for rspamd/faq page(s) to communicate awareness to users.

It's probably unlikely that use_esld needs to be set to false? This is just storage of the private key within DMS for signing, and it's ok to use the same DKIM private key for various sender subdomains? (AFAIK they can all point to the same public key DNS record, or individual DNS records with the same public key)

georglauterbach · 2023-12-29T13:26:06Z

@denisix please address the PR feedback; we can then go ahead and merge the PR.

georglauterbach · 2024-01-10T13:11:49Z

last ping @denisix

polarathene

As the contributor is not engaging with review feedback, I'll apply my change suggestion.

DMS could better manage this internally and simplify on configuration a user needs to be aware of and manually manage via docs, but that'll need someone to contribute the change. A separate issue for tracking that with all the information discussed here has been opened.

Regarding the concern with use_esld = true and DKIM related rspamd bug reports, maintainers should be aware of this behaviour where it can affect some users that deviate from our happy path of hostname: mail.example.com with [email protected] mail domains if they have trouble with $domain expecting to match a marketing.example.com (eSLD normalization will look for example.com instead, which may not work if the user has [email protected] accounts?), instead of example.com (which is probably what they should adjust for, it's ok to use the same key for subdomains).

Since that setting has nothing to do with the contribution here, it's already true in the docs above, I'll go ahead and merge 👍 (we could improve on the docs a bit more by explaining the suggested config further though, especially with the path that isn't actually valid presently)

polarathene · 2024-01-14T23:47:12Z

docs/content/config/best-practices/dkim_dmarc_spf.md

+        selector = "mail";
+        path = "/tmp/docker-mailserver/opendkim/keys/$domain/$selector.private"; # this will automatically match keys for domains
+
+        # domain specific configurations can be provided below:


This feedback has been migrated to a separate TODO issue: #3778

polarathene · 2024-01-14T23:48:00Z

docs/content/config/best-practices/dkim_dmarc_spf.md

+        selector = "mail";
+        path = "/tmp/docker-mailserver/opendkim/keys/$domain/$selector.private"; # this will automatically match keys for domains


This context with source citing is now also part of the related TODO issue: #3778

docs/content/config/best-practices/dkim_dmarc_spf.md

github-actions · 2024-01-15T00:07:07Z

Documentation preview for this PR is ready! 🎉

Built with commit: 405be2c

williamdes · 2024-01-20T13:07:37Z

docs/content/config/best-practices/dkim_dmarc_spf.md

+        # The path location is searched for a DKIM key with these variables:
+        # - `$domain` is sourced from the MIME mail message `From` header
+        # - `$selector` is configured for `mail` (as a default fallback)
+        path = "/tmp/docker-mailserver/dkim/keys/$domain/$selector.private";


This path is wrong, currently the keys are in: /tmp/docker-mailserver/opendkim/keys/

I have used path = "/etc/opendkim/keys/$domain/$selector.private"; until now

This path is wrong

It's an example and was explicitly changed to that by me for the docs.

The contributor used /tmp/docker-mailserver/... instead of /etc/... but otherwise they also referred to opendkim.

Not sure why you'd want OpenDKIM as the path for rspamd though? I want this to be a unified location for DKIM keys, but someone will need to contribute that change.

Well, it's more that rspamd wanted to do signing before I would even know it. So I patched the path and selector to use open dkim path. Since opendkim was the first dkim stuff I had setup
Just feels like there is too many moving components in DMS and without a diagram I can not decide to shut down one component or another.
Anyway this config allows to local dkim sign and that's all I needed to pass 👍

Update dkim_dmarc_spf.md

02f09ef

using DKIM signing in Rspamd - automatically match keys for domains in dkim_signing.conf

polarathene requested changes Dec 16, 2023

View reviewed changes

polarathene changed the title ~~Update dkim_dmarc_spf.md~~ docs: Rspamd DKIM config simplify via path setting Dec 16, 2023

polarathene added kind/improvement Improve an existing feature, configuration file or the documentation area/documentation service/security/dkim-dmarc-spf service/security/rspamd labels Dec 16, 2023

polarathene added this to the v13.1.0 milestone Dec 16, 2023

polarathene mentioned this pull request Dec 23, 2023

[TODO]: Consider revising DKIM generation #3630

Open

georglauterbach modified the milestones: v13.1.0, v14.0.0 Dec 29, 2023

georglauterbach self-requested a review December 29, 2023 13:25

polarathene mentioned this pull request Jan 14, 2024

[TODO]: Consider rspamd DKIM config to use selector_map #3778

Open

polarathene previously approved these changes Jan 14, 2024

View reviewed changes

polarathene dismissed their stale review via 2a0af43 January 14, 2024 23:59

Update docs/content/config/best-practices/dkim_dmarc_spf.md

2a0af43

polarathene requested changes Jan 15, 2024

View reviewed changes

docs/content/config/best-practices/dkim_dmarc_spf.md Outdated Show resolved Hide resolved

polarathene added 2 commits January 15, 2024 13:05

Update docs/content/config/best-practices/dkim_dmarc_spf.md

a041eea

Merge branch 'master' into patch-1

405be2c

polarathene approved these changes Jan 15, 2024

View reviewed changes

polarathene merged commit ce6ebcc into docker-mailserver:master Jan 15, 2024

georglauterbach modified the milestones: v14.0.0, v13.3.0 Jan 15, 2024

williamdes reviewed Jan 20, 2024

View reviewed changes

pitilux mentioned this pull request Sep 5, 2024

bug report: Rspamd DKIM private key file '/tmp/docker-mailserver/rspamd/dkim/$domain/$selector.private' is configured for usage, but does not appear to exist #4172

Closed

1 task

polarathene mentioned this pull request Sep 28, 2024

scripts: improve DKIM path scanning in Rspamd setup #4201

Merged

8 tasks

		selector = "mail";
		path = "/tmp/docker-mailserver/opendkim/keys/$domain/$selector.private"; # this will automatically match keys for domains

Uh oh!

docs: Rspamd DKIM config simplify via path setting #3702

docs: Rspamd DKIM config simplify via path setting #3702

Uh oh!

Conversation

denisix commented Dec 16, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Type of change

Checklist:

Uh oh!

polarathene left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

polarathene commented Dec 17, 2023

Uh oh!

georglauterbach commented Dec 19, 2023

Uh oh!

polarathene commented Dec 19, 2023

Uh oh!

georglauterbach commented Dec 29, 2023

Uh oh!

georglauterbach commented Jan 10, 2024

Uh oh!

polarathene left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Jan 15, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

docs: Rspamd DKIM config simplify via `path` setting #3702

docs: Rspamd DKIM config simplify via `path` setting #3702

denisix commented Dec 16, 2023 •

edited

Loading

polarathene left a comment •

edited

Loading