Set Up DKIM Signing with OpenDKIM

Configure DKIM on your mail server using OpenDKIM. Learn how to generate key pairs, configure lookup tables, and integrate OpenDKIM with Postfix.

Last updated: July 2026

In short: To sign outgoing emails cryptographically, OpenDKIM is integrated as a milter with your MTA (such as Postfix). Key generation is handled by the opendkim-genkey utility. Within OpenDKIM, you can assign keys to domains either statically using the Domain, KeyFile, and Selector options, or dynamically via KeyTable and SigningTable.

Implementing DKIM (DomainKeys Identified Mail) is a fundamental step to ensure email deliverability. When your mail server sends unsigned messages, scanners like Kuveris will flag the lack of signatures. With OpenDKIM, you can automatically sign outgoing messages for your domains.

Generating Keys with opendkim-genkey

The first step is to generate a cryptographic key pair for your domain using the opendkim-genkey tool.

The official manuals explain its purpose: opendkim-genkey generates (1) a private key for signing messages using opendkim(8) and (2) a DNS TXT record suitable for inclusion in a zone file which publishes the matching public key for use by remote DKIM verifiers.

To generate the keys, run the utility with your chosen selector: Run the script "opendkim-genkey -s SELECTOR". The opendkim-genkey man page has full details of options. This will generate a private key in PEM format and output a TXT record containing the matching public key appropriate for insertion into your DNS zone file.

The -s option designates the selector name: Specifies the selector, or name, of the key pair generated. The default is "default".

Upon completion, you will find two files: The filenames of these are based on the selector (see below); the private key will have a suffix of ".private" and the TXT record will have a suffix of ".txt".

For instance, executing opendkim-genkey -s mail creates mail.private (the private key, which must remain secure on the server) and mail.txt (which contains the public key record).

Publishing the Public Key in DNS

The record generated in the .txt file must be published in your domain's DNS zone as a TXT resource record.

According to the specification: The public key DNS record should appear as a TXT resource record at: SELECTOR._domainkey.DOMAIN

The published record will look similar to this:

v=DKIM1; t=y; p=MFwwDQYJ...AwEAAQ==

Configuring OpenDKIM (opendkim.conf)

The daemon configuration is managed in /etc/opendkim.conf.

Operating Mode

The Mode directive controls whether OpenDKIM signs outgoing mail, verifies incoming mail, or both: Selects operating modes. The string is a concatenation of characters that indicate which mode(s) of operation are desired. Valid modes are s (signer) and v (verifier). The default is sv

Configure this option in your configuration file:

Mode sv

Connection Socket

The MTA communicates with OpenDKIM using the Socket directive: Specifies the socket that should be established by the filter to receive connections from sendmail(8) in order to provide service. socketspec is in one of two forms: local:path, which creates a UNIX domain socket at the specified path, or inet:port[@host] or inet6:port[@host] which creates a TCP socket on the specified port and in the specified protocol family.

Example using a TCP port on localhost:

Socket inet:8891@localhost

Signing Modes: Single Domain vs. Multi-Domain

When signing mode is active, you must configure one of the following setups: When signing mode is enabled, one of the following combinations must also be set: (a) Domain, KeyFile, Selector, no KeyTable, no SigningTable; (b) KeyTable, SigningTable, no Domain, no KeyFile, no Selector; (c) KeyTable, SetupPolicyScript, no Domain, no KeyFile, no Selector.

Setup (a): Single Domain Configuration

If you only need to sign emails for a single domain, configure these three basic options:

Domain: A set of domains whose mail should be signed by this filter. Mail from other domains will be verified rather than being signed.
KeyFile: Gives the location of a PEM-formatted private key to be used for signing all messages. Ignored if a KeyTable is defined.
Selector: Defines the name of the selector to be used when signing messages.

Example:

Domain example.com
KeyFile /etc/dkimkeys/mail.private
Selector mail

Setup (b): Multi-Domain Configuration (KeyTable & SigningTable)

For mail servers hosting multiple domains, use lookup tables:

KeyTable: Gives the location of a file mapping key names to signing keys. If present, overrides any KeyFile setting in the configuration file. The data set named here maps each key name to three values: (a) the name of the domain to use in the signature’s "d=" value; (b) the name of the selector to use in the signature’s "s=" value; and (c) either a private key or a path to a file containing a private key.
SigningTable: Defines a table used to select one or more signatures to apply to a message based on the address found in the From: header field. Keys in this table vary depending on the type of table used; values in this data set should include one field that contains a name found in the KeyTable (see above) that identifies which key should be used in generating the signature

Example declarations in opendkim.conf:

KeyTable refile:/etc/opendkim/KeyTable
SigningTable refile:/etc/opendkim/SigningTable

Running the Daemon

When running the daemon manually or checking its status, the recommended command line flags are: The current recommended set of command line options is: -l -p SOCKETSPEC -d DOMAIN -k KEYPATH -s SELECTOR

MTA Integration (Postfix Configuration)

To route outbound emails through OpenDKIM, you must configure Postfix to connect to the milter socket.

Add the milter settings to your /etc/postfix/main.cf: Add the following lines like this example to your postfix main.cf using your desired socket specification: smtpd_milters = inet:localhost:8891 non_smtpd_milters = inet:localhost:8891

Example configuration:

smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891

Verifying the DNS Record (opendkim-testkey)

Before putting your configuration into production, use the opendkim-testkey tool to check that your published public key matches your local private key:

opendkim-testkey -d DOMAIN -s SELECTOR -k rsa.private

Example command:

opendkim-testkey -d example.com -s mail -k /etc/dkimkeys/mail.private

If the command completes without errors, reload the OpenDKIM and Postfix services. You can then test outbound emails using the free Kuveris scanner to ensure they carry valid DKIM signatures.