OpenDKIM Key Rotate

Automates the task of rotating OpenDKIM keys by generating new keys for the existing domains in a temporary location, creating new DNS entries in Linode, and installing the keys to production.

It will perform the following tasks:

1. Generate a new key for each domain configured to use OpenDKIM to a temporary directory.
   • The selector will be today's date in YYYYMMDD format with microseconds. This allows you to generate keys multiple times in a single day while still providing some level of anonymity to cloak when it was created.
   • Temporary directory which contains the public and private keys will be readable only by root.
2. Create new TXT DNS records using the new selector. Currently only supports the Linode API but other DNS providers can be added.
3. Script will pause and wait for user input before installing the keys. This allows DNS changes to take effect.
4. Verifies the setup of signing and verifying (private and public) keys; and, if successful:
5. Installs private keys
6. Update KeyTable with new selector for domains.
7. Restarts Postfix and OpenDKIM daemons.

Note that this script was initially created to automate this rather simple but error prone set of tasks that make up the OpenDKIM key rotation responsibility that needs to occur at most every few months. It was created specifically for a certain mail system that runs Ubuntu, Postfix, and OpenDKIM from Apt sources although modifications to handle other configurations are certainly welcome.

System Configuration

Script makes several assumptions about the system it's being run on. Specifically:

• Python 2.7 or greater. Untested with Python 3 but may work.
• OpenDKIM is installed using Apt.
• OpenDKIM is configured to use the "KeyTable" data set. Example settings relevant to this script:

KeyTable            /etc/dkimkeys/key.table
SigningTable        refile:/etc/dkimkeys/signing.table

• Path to OpenDKIM configuration /etc/opendkim.conf

Usage

Script must be run as root.

Add the Linode API key as an environment variable LINODE_API_KEY prior to running.

$ sudo rotate_opendkim_keys.py

It will generate private and public keys for each domain listed in OpenDKIM's config, displaying the domain and steps taken along the way.

At this point the script will pause before continuing. This is intended as a way to let DNS propegate as the OpenDKIM testing process will use DNS to verify the keys.

After some amount of time press any key to continue. For reference, Linode typically takes at least 15 minutes.

The OpenDKIM filter installation test will then test each of the new keys. If they all succeed then the new keys will be installed and the Postfix and OpenDKIM daemons are restarted.