DMS not DKIM signing emails for specific domain

[xtzws]

Hi,

I've been having an issue for a few weeks where outgoing emails on a specific domain are not signed with DKIM. For example, I have company.com, personal.org, and infra.xyz setup, but only infra.xyz isn't signed correctly while the others are. I'm using rspamd and I've verified that the config (both for DMS and rspamd override) is correct, I don't see any errors in rspamd.log, and the DNS record exists correctly formatted (which I just rotated). I'd really appreciate any tips because it's driving me crazy.

rspamd is enabled, opendkim is disabled, and I'm running DMS 16.0.1 with eight different domains enabled. The emails have no DKIM header at all so it's not an issue of key mismatch.

Thanks

Here's my rspamd override:

# documentation: https://rspamd.com/doc/modules/dkim_signing.html

enabled = true;

sign_authenticated = true;
sign_local = true;

use_domain = "header";
use_redis = false; # don't change unless Redis also provides the DKIM keys
use_esld = true;
allow_username_mismatch = true;

check_pubkey = true; # you want to use this in the beginning

domain {
    company.com {
        path = "/tmp/docker-mailserver/rspamd/dkim/rsa-2048-mail-company.com.private.txt";
        selector = "mail";
    }
    personal.org {
        path = "/tmp/docker-mailserver/rspamd/dkim/rsa-2048-mail-personal.org.private.txt";
        selector = "mail";
    }
    infra.xyz {
        path = "/tmp/docker-mailserver/rspamd/dkim/rsa-2048-mail-infra.xyz.private.txt";
        selector = "mail";
    }
}

[nicholas-greenwood]

your allow_username_mismatch = true only relaxes the authenticated username domain check. rspamd checks the smtp envelope sender against the From header separately, even with use_domain = "header". with use_esld = true, it compares their base domains

could you share those 2 domains from 1 unsigned infra.xyz message? a mismatch could explain the missing signature. if they match, the dkim_signing debug output would help narrow it down. that mismatch check logs at debug level, so no errors in rspamd.log doesn't rule it out

[xtzws]

Thanks for pointing those out. I enabled dkim logging and that seems to have fixed it for some reason.