DomainKeys implemenatation overview

[Opesh Alkara]

Hi Group,
 I would like to share the knowledge of implementing domainkeys:
 The Basic things required is : 
Sendmail 8.13 or above
dk-filter-0.3.0
SASL packages
openSSL packages
  First of all you untar the sendmail source and add the following line (if 
they are not already there) at the end of the file site.config.m4 in the 
path sendmail-8.13.4/devtools/Site/site.config.m4:
 APPENDDEF(`confENVDEF',`-DSTARTTLS')
APPENDDEF(`confLIBS', `-lssl -lcrypto')
APPENDDEF(`confLIBDIRS', `-L/usr/local/ssl/lib -R/usr/local/ssl/lib')
APPENDDEF(`confINCDIRS', `-I/usr/local/ssl/include')
APPENDDEF(`conf_sendmail_ENVDEF', `-DMILTER') 
 Enter the directory sendmail-8.13.4/libmilter/ and run
 #./Build
#./Build install
 to install the libmilter.a library required for mail filters options in 
sendmail.
 Now compile the sendmail source by entering into the root source directory 
 # cd sendmail-8.13.4/
# ./Build 
#./Build install
 this will compile and install the sendmail source in the server.
 configure the sendmail with the following option in the
sendmail.mc<http://sendmail.mc/>file:
 INPUT_MAIL_FILTER(`dk-filter', `S=inet:2500 at localhost')
  here dk-filter stands for Domain Key filter and 2500 is the port in which 
the dk-filter daemon will listen.
 # m4 /etc/mail/sendmail.mc > /etc/mail/sendmail.cf
 Now you need to compile dk-milter-0.3.0.tar.gz source. Untar the source and 
add the following line (if they are not already there) at the end of the 
file site.config.m4 in the path dk-milter-0.3.0/devtools/Site/site.config.m4: 

 APPENDDEF(`confENVDEF',`-DSTARTTLS')
APPENDDEF(`confLIBS', `-lssl -lcrypto')
APPENDDEF(`confLIBDIRS', `-L/usr/local/ssl/lib -R/usr/local/ssl/lib')
APPENDDEF(`confINCDIRS', `-I/usr/local/ssl/include')
APPENDDEF(`conf_sendmail_ENVDEF', `-DMILTER') 
 Edit the file dk-milter-0.3.0/dk-filter/Makefile.m4 to contain these 
options:
  ##################################################################
 
include(confBUILDTOOLSDIR`/M4/switch.m4')


define(`confMT', `TRUE')
define(`confREQUIRE_LIBSM', `true')

APPENDDEF(`confLIBS', `-lssl -lcrypto')
dnl Enable and edit these paths as needed:
APPENDDEF(`confINCDIRS', `-I/usr/local/ssl/include ')
APPENDDEF(`confLIBDIRS', `-L/usr/local/ssl/lib ')

dnl To use the asynchronous resolver library provided, enable this line:
dnl bldPUSH_SMLIB(`ar')

bldPUSH_SMLIB(`dk')
APPENDDEF(`confINCDIRS', `-I../libdk/ ')

bldPUSH_SMLIB(`sm')

dnl Enable these next line if needed to specify the locations of libmilter.a
dnl and the libmilter include files:
APPENDDEF(`confINCDIRS', `-I/usr/local/sendmail/include')
APPENDDEF(`confLIBDIRS', `-L/usr/local/sendmail/libmilter') 
APPENDDEF(`confLIBDIRS', `-L/usr/local/sendmail/libsm')
APPENDDEF(`confLIBDIRS', `-L/usr/local/sendmail/libsmdb')
APPENDDEF(`confLIBDIRS', `-L/usr/local/sendmail/libsmutil')

dnl Enable for IPv6 support:
dnl APPENDDEF(`confENVDEF', `-DNETINET6 ')

dnl Compile time options, especially FFRs:
dnl APPENDDEF(`confENVDEF', `-D_FFR_EXTERNAL_IGNORE_LIST ')
dnl APPENDDEF(`confENVDEF', `-D_FFR_FLUSH_HEADERS ')
dnl APPENDDEF(`confENVDEF', `-D_FFR_MACRO_LIST ')
APPENDDEF(`confENVDEF', `-D_FFR_MULTIPLE_KEYS ')
dnl APPENDDEF(`confENVDEF', `-D_FFR_REPORTINFO ')
dnl APPENDDEF(`confENVDEF', `-D_FFR_REQUIRED_HEADERS ')
dnl APPENDDEF(`confENVDEF', `-D_FFR_SELECT_CANONICALIZATION ') 

dnl If you do POP before SMTP:
dnl APPENDDEF(`confENVDEF', `-DPOPAUTH ')
dnl APPENDDEF(`confINCDIRS', `-I/usr/local/BerkeleyDB/include')
dnl APPENDDEF(`confLIBDIRS', `-L/usr/local/BerkeleyDB/lib')
dnl PREPENDDEF(`confLIBS', `-ldb ') 

bldPRODUCT_START(`executable', `dk-filter')
define(`bldSOURCES', `dk-filter.c util.c ')
PREPENDDEF(`confLIBS', `-lmilter ')
bldPRODUCT_END

bldPRODUCT_START(`manpage', `dk-filter')
define(`bldSOURCES', `dk-filter.8')
bldPRODUCT_END

bldFINISH

#######################################################
now build the source by command
  # ./Build 
#./Build install
 Generate a public/private key pair for your domain using the command:
 #openssl genrsa -out rsa.private 768
#openssl rsa -in rsa.private -out rsa.public -pubout -outform PEM
 Move you private key to /usr/share/ssl/private/ with file name *
example.com_key.pem* .
 Publish you public key in the DNS server for domain
example.com<http://example.com/>as a TXT record:
 mail._domainkey.example.com. 1D IN TXT "g=; k=rsa; t=y; 
p=MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAJUf/A69N7tYPcoursysqYFzBl3+yzCCUsNQAY6TIcD02OEix1xETOOubJ1Z5i7UrR3E36aEeeHA9tdDu1P+xvQ6PoQEXeevGWfs61j4lVRQErx4Km+KKcqja6nSgZbflQIDAQAB"

 Notice the double quotes that start from *"g=;* and end upto the end of key 
i.e. upto *QAB"*
 Replace example.com <http://example.com/> by your domain name for which you 
want to implement domainkey.
 *mail* in the DNS record *mail*._domainkey.example.com. is selector to 
select the key. You can place multiple keys in the form of text record and a 
selector asociated with each key. While starting the DomainKey Daemon you 
need to specify which selector to use while signing the mail for
example.com<http://example.com/>
.
 Now restart your DNS service
 create a user for Domain Key filter and start dk-filter daemon by the 
following command :
 dk-filter -l -p inet:2500 at localhost -c nofws -d
example.com<http://example.com/>-D -H -s
/usr/share/ssl/private/example.com_key.pem -S mail -u dkuser -m MTA

  Send mail to any Yahoo! ID and check to see whether the 
authentication-results header shows result as pass or fail.
 Thanks,
Opesh Alkara