Struggling with DKIM signing

[Damian]

> For the Postfix bit, I already have:
> #=====================================================================
> # Global antivirus/antispam pre-filter (Amavis)
> #=====================================================================
> smtp-amavis  unix -     -       n       -       5       smtp
>     -o smtp_data_done_timeout=1200
>     -o smtp_send_xforward_command=yes
>     -o disable_dns_lookups=yes
>     -o max_use=20
> # SMTP interface for injecting mail into Amavis
> 127.0.0.1:10025 inet n    -    n    -    -  smtpd
>     -o content_filter=smtp-amavis:[127.0.0.1]:10024
>     -o smtpd_restriction_classes=
>     -o smtpd_client_restrictions=
>     -o smtpd_helo_restrictions=
>     -o smtpd_sender_restrictions=
>     -o smtpd_recipient_restrictions=permit_mynetworks,reject
>     -o mynetworks=127.0.0.0/8
>     -o smtpd_authorized_xforward_hosts=127.0.0.0/8
>     -o strict_rfc821_envelopes=yes
>     -o smtpd_error_sleep_time=0
>     -o smtpd_soft_error_limit=1001
>     -o smtpd_hard_error_limit=1000
> #=====================================================================
> # Mail re-injection (after pre-filtering)
> #=====================================================================
> 127.0.0.1:10026 inet n    -    n    -    -  smtpd
>     -o content_filter=
>     -o smtpd_restriction_classes=
>     -o smtpd_delay_reject=no
>     -o smtpd_client_restrictions=permit_mynetworks,reject
>     -o smtpd_helo_restrictions=
>     -o smtpd_sender_restrictions=
>     -o smtpd_recipient_restrictions=permit_mynetworks,reject
>     -o smtpd_data_restrictions=reject_unauth_pipelining
>     -o smtpd_end_of_data_restrictions=
>     -o mynetworks=127.0.0.0/8
>     -o smtpd_error_sleep_time=0
>     -o smtpd_soft_error_limit=1001
>     -o smtpd_hard_error_limit=1000
>     -o smtpd_client_connection_count_limit=0
>     -o smtpd_client_connection_rate_limit=0
>
So you removed the submission service?

A "usual" mail flow is "sender at external.domain -> smtpd(:25) -> 
content_filter(:10024) -> smtpd(:10025)", in which the latter 10025 does 
not have another Amavis content_filter.

Additional mail flows may be necessary such as for your DKIM use-case, 
e.g. "sender at internal.domain -> smtpd(:submission) -> 
content_filter(:10026) -> smtpd(:10025)", so Port 10026 would have to be 
bound by Amavis, not Postfix.

As Matus has written, other constellations are possible.

> Do I just duplicate the two sections starting 127.0.0.1, changing the 
> ports but leave the first smtp-amavis section?
I don't see a use-case for smtpd(:10026) here.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.amavis.org/pipermail/amavis-users/attachments/20241105/bc16b2d8/attachment.htm>