Rspamd dkim signing with Postfix... using virtual_alias_domains and virtual_aliases.

[sjh-misc]

Hi...

I'm trying to configure RSpamD (4.1.1-1~0f29274~trixie) to perform DKIM signing for outgoing email. I already have rspamd integrated with Postfix (3.10.5-1~deb13u1) using the local.d/milter_headers.conf approach. My Postfix server uses virtual_alias_domains to process email for two domains - and uses virtual_alias_maps to associate supported email addresses with accounts expressed in the form: `user@loclahost'. This works fine for mail delivery to dovecot LMTP.

I've been following the DKIM Signing: Complete Setup Guide - which makes sense up-until Step 5 "Test DKIM signing". Slavishly following the guide, I get this behaviour:

$ echo "Test message" | rspamc -d example.com -f test@example.com
option parsing failed: Cannot parse integer value “test@example.com” for -f

The manual page for rspamc suggests that using -f in this way is not valid... perhaps the guide intended the capital letter option -F instead?

$ echo "Test message" | rspamc -d example.com -F test@example.com
Results for file: stdin (0.284 seconds)
[Metric: default]
Action: reject
Spam: true
Score: 27.40 / 15.00
Symbol: ALIAS_RESOLVED (0.00)
Symbol: ARC_NA (0.00)
Symbol: DMARC_NA (0.00)[No From header]
Symbol: HFILTER_FROMHOST_NOT_FQDN (3.00)[localhost]
Symbol: HFILTER_HOSTNAME_UNKNOWN (2.50)
Symbol: MIME_GOOD (-0.10)[text/plain]
Symbol: MIME_TRACE (0.00)[0:+]
Symbol: MISSING_DATE (1.00)
Symbol: MISSING_ESSENTIAL_HEADERS (7.00)
Symbol: MISSING_FROM (2.00)
Symbol: MISSING_MID (2.50)
Symbol: MISSING_SUBJECT (0.50)
Symbol: MISSING_TO (2.00)
Symbol: MISSING_XM_UA (0.00)
Symbol: RCVD_COUNT_ZERO (0.00)[0]
Symbol: R_DKIM_NA (0.00)
Symbol: R_MISSING_CHARSET (0.00)
Symbol: SHORT_PART_BAD_HEADERS (7.00)
Symbol: SINGLE_SHORT_PART (0.00)
Message-ID: undef

With -F Rspamd does seem to process the message sent on stdin. It is not clear if this output confirms DKIM signing is working... or not. When I send email through Postfix, as an authenticated user for test@example.com , no DKIM headers are present when the email is received... so something is not working.

While it wasn't mentioned in the guide, I did ensure Postfix integration includes both these lines:

smtpd_milters = inet:localhost:11332
non_smtpd_milters = inet:localhost:11332

When I put debug_modules = ["dkim_signing"]; into /etc/rspamd/local.d/logging.inc I notice these three lines:

...: <883d58>; dkim_signing; lua_dkim_tools.lua:190: user is authenticated
...: <883d58>; dkim_signing; lua_dkim_tools.lua:425: use domain(auth) for signature: nil
...: <883d58>; dkim_signing; lua_dkim_tools.lua:431: could not extract dkim domain

I suspect the second of these is why I'm not seeing signed emails. In Thunderbird, the SMTP configuration gives "User name" in the form user - for which there is a local account on the mail server called user. Email addresses are mapped from the domains for which I've configured DKIM keys to identifiers of the form user@localhost in /etc/postfix/virtual_alias by Postfix. In order to convince Dovecot LMTP to accept emails from Postfix, I needed /etc/dovecot/conf.d/20-lmtp.conf to include the line:

auth_username_format = %{user | username | lower}

I can't map to email addresses including the domains for which I want dkim signatures... because I want foo@example1.com and bar@example2.com to both be delivered to a single user account called baz (which is baz@localhost in /etc/postfix/virtual_alias .)

I've populated /etc/rspamd/local.d/virtual_aliases with:

virtual_aliases = "/etc/postfix/virtual_alias";
enabled = true;

So... in principle, rspamd should know the user-accounts which are authenticated for delivery to Dovecot LMTP. (Dovecot provides the SASL authorisations for Postfix in my setup.)

Do I need something similar (in reverse) so a user (authenticated as user@localhost) can send email for name@example1.com and other_name@example2.com? How should I configure Rspamd to tell it which domains should be dkim signed for an authenticated user? I would be satisfied if every authenticated user could sign email for every supported domain... but I can't see how to do this.

Hints/pointers would be very welcome. :-)

[moisseev]

That guide is balderdash (the rspamc examples are just wrong); we are rewriting it.

Your signing failure isn't Postfix. Your log:

use domain(auth) for signature: nil
could not extract dkim domain

You set use_domain = "auth", so Rspamd takes the signing domain from the authenticated user — but you stripped the domain off yourself: auth_username_format = %{user...} reduces baz@example1.com to bare
baz, and you collapsed every domain onto that one account. There's nothing left to sign as.

The signing domain belongs in the From: header (use_domain = "header") — but Rspamd only permits that when the auth user actually matches the domain, which your stripped baz doesn't. The real fix is to
stop erasing the domain from auth (let users authenticate as their real address), not to pile virtual_aliases and more flags on top. virtual_aliases in Rspamd maps addresses; it has nothing to do with
picking the signing domain.

(echo "Test message" also can't demonstrate signing — it has no From: header. That one's the guide's fault, not yours.)

[sjh-misc]

Hi moisseev...

I'm pleased to hear that the guide should be improved at some point.... It did prove somewhat misleading. :-)

I also posted a closely related stack-exchange question about this:

https://serverfault.com/questions/1199449/postfix-rspamd-dkim-signing-module-multiple-domains-how-to-select-correct-do

A few minutes before your reply to me on Github, I'd satisfied myself that I had solved my practical issue, so posted it as an answer there.

I concede that, if only the authenticated user needed to sign emails from the domain against which authentication had been done, then that would be easiest to configure in Rspamd. However... I'm not piling virtual_aliases on top - per se. I'm using virtual aliases because I want each user of the mail server to be able to (send and) receive emails from a variety of email addresses at multiple domains. I don't want to force each user to maintain separate IMAP accounts (with separate authentication) for each email address "identity" that they could otherwise configure for a single account (with just one username and password to keep safe) in Thunderbird.

I now have a configuration (Postfix, Dovecot and Rspamd) that signs outgoing mail (if and only if) the user would receive a reply to the same email address - though configuration was more of a challenge, than I had initially expected... in the context of the other hard constraints. I'm pleased that the use_domain_custom facility is supported by Rspamd - though better official documentation about how to use it would have been really helpful. :-)