Set Up DKIM Signing in Rspamd

Enable automatic DKIM signing for outgoing emails in Rspamd. Learn how to generate secure keys and configure the dkim_signing module.

Last updated: July 2026

In short: Outbound email signing via DKIM can be configured in Rspamd using the dkim_signing module. This requires that outbound mail is processed by Rspamd. Cryptographic key pairs are generated using the rspamadm dkim_keygen tool and stored on the filesystem.

When using Rspamd for spam filtering on your mail server, you can also configure it to cryptographically sign outgoing emails with DKIM signatures. If security scanners like Kuveris report that your outbound emails lack valid DKIM signatures, this guide will help you resolve the finding.

Prerequisite: Outbound Mail Scanning

Before configuring DKIM signing, you must ensure that your outbound mail flow is routed through Rspamd for scanning.

The official documentation notes: For DKIM signing to work, you must scan outbound mail with rspamd.

Furthermore, Rspamd restricts signing eligibility to verified outbound mail sources: In order to be eligible for signing, an email must either be received from an authenticated user, a reserved (local) IP address, or an address in the sign_networks map (if defined).

Generating Keys with rspamadm dkim_keygen

Rspamd provides a built-in key generation tool called rspamadm dkim_keygen.

To generate a simple key, execute: rspamadm dkim_keygen -s 'test' -d example.com

To generate a secure 2048-bit RSA key and save the private key directly to a file while redirecting the public TXT record to another file, run: rspamadm dkim_keygen -s 'woosh' -b 2048 -d example.com -k example.private > example.txt

The flags control key properties: -b 2048 specifies a 2048 bit key size (the standard default 1024 bit size is weak)

The command outputs two components:

The private key (saved to example.private), which must remain secure on the server.
The public key: The second part is the public DNS TXT record that you should place in your DNS zone file.

Publish the public TXT record in your domain's DNS zone (e.g., under woosh._domainkey.example.com).

Configuring the dkim_signing Module

Configure Rspamd's signing options in /etc/rspamd/local.d/dkim_signing.conf.

Path and Selector

By default, Rspamd resolves key paths based on the effective Second-Level Domain (eSLD): For example, the search path for user@test.example.com would be /var/lib/rspamd/dkim/example.com.dkim.key. If a key is found, the message will be signed.

You can define custom path and selector search options using variables like $domain and $selector in the configuration file:

path = "/var/lib/rspamd/dkim/$domain.$selector.key";

The default selector used by Rspamd is dkim: # Default selector to use selector = "dkim";

File Permissions

Rspamd must be able to read your private key files to calculate signatures: This requires the keys to be accessible by the user or group _rspamd.

Ensure the private key files are readable by the _rspamd system user (e.g., using chown _rspamd /var/lib/rspamd/dkim/*.key).

Domain Matching and Verification Settings

In the configuration file, you can specify how Rspamd determines the signing domain and whether it allows mismatches:

Sign Domain Selection (use_domain): # Domain to use for DKIM signing: can be "header" (MIME From), "envelope" (SMTP From), "recipient" (SMTP To), "auth" (SMTP username) or directly specified domain name use_domain = "header";
Envelope/Header Domain Mismatch (allow_hdrfrom_mismatch): # If true, envelope/header domain mismatch is ignored allow_hdrfrom_mismatch = false;
Authenticated Username Mismatch (allow_username_mismatch): # If true, username does not need to contain matching domain allow_username_mismatch = false;

Overriding Settings per Domain

If you need domain-specific paths or selectors, define them inside a domain { } block: domain { # Domain name is used as key example.com { # Private key path path = "/var/lib/rspamd/dkim/example.key"; # Selector selector = "ds"; } }

Signature Algorithms

When generating signatures, Rspamd applies standard signature options: Rspamd always uses relaxed/relaxed encoding with the rsa-sha256 signature algorithm

Verifying Your Setup

After editing /etc/rspamd/local.d/dkim_signing.conf, reload Rspamd (systemctl reload rspamd). Send a test email through your mail server to an external address and run a scan on the free Kuveris scanner to verify that your messages are correctly signed and that the DKIM signature passes DNS validation.