Struggling with DKIM signing

[Nick Howitt]

On 05/11/2024 15:29, Damian wrote:
>> For the Postfix bit, I already have:
>> #=====================================================================
>> # Global antivirus/antispam pre-filter (Amavis)
>> #=====================================================================
>> smtp-amavis  unix -     -       n       -       5       smtp
>>     -o smtp_data_done_timeout=1200
>>     -o smtp_send_xforward_command=yes
>>     -o disable_dns_lookups=yes
>>     -o max_use=20
>> # SMTP interface for injecting mail into Amavis
>> 127.0.0.1:10025 inet n    -    n    -    -  smtpd
>>     -o content_filter=smtp-amavis:[127.0.0.1]:10024
>>     -o smtpd_restriction_classes=
>>     -o smtpd_client_restrictions=
>>     -o smtpd_helo_restrictions=
>>     -o smtpd_sender_restrictions=
>>     -o smtpd_recipient_restrictions=permit_mynetworks,reject
>>     -o mynetworks=127.0.0.0/8
>>     -o smtpd_authorized_xforward_hosts=127.0.0.0/8
>>     -o strict_rfc821_envelopes=yes
>>     -o smtpd_error_sleep_time=0
>>     -o smtpd_soft_error_limit=1001
>>     -o smtpd_hard_error_limit=1000
>> #=====================================================================
>> # Mail re-injection (after pre-filtering)
>> #=====================================================================
>> 127.0.0.1:10026 inet n    -    n    -    -  smtpd
>>     -o content_filter=
>>     -o smtpd_restriction_classes=
>>     -o smtpd_delay_reject=no
>>     -o smtpd_client_restrictions=permit_mynetworks,reject
>>     -o smtpd_helo_restrictions=
>>     -o smtpd_sender_restrictions=
>>     -o smtpd_recipient_restrictions=permit_mynetworks,reject
>>     -o smtpd_data_restrictions=reject_unauth_pipelining
>>     -o smtpd_end_of_data_restrictions=
>>     -o mynetworks=127.0.0.0/8
>>     -o smtpd_error_sleep_time=0
>>     -o smtpd_soft_error_limit=1001
>>     -o smtpd_hard_error_limit=1000
>>     -o smtpd_client_connection_count_limit=0
>>     -o smtpd_client_connection_rate_limit=0
>>
> So you removed the submission service?
> 
> A "usual" mail flow is "sender at external.domain -> smtpd(:25) -> 
> content_filter(:10024) -> smtpd(:10025)", in which the latter 10025 does 
> not have another Amavis content_filter.
> 
> Additional mail flows may be necessary such as for your DKIM use-case, 
> e.g. "sender at internal.domain -> smtpd(:submission) -> 
> content_filter(:10026) -> smtpd(:10025)", so Port 10026 would have to be 
> bound by Amavis, not Postfix.
> 
> As Matus has written, other constellations are possible.
> 
>> Do I just duplicate the two sections starting 127.0.0.1, changing the 
>> ports but leave the first smtp-amavis section?
> I don't see a use-case for smtpd(:10026) here.
Sorry, but I am trying to get something going that was based on the 
ClearOS configs but I've copied over too much and then mixed it with 
internet references.

127.0.0.1:10026 looks like a ClearOS thing and is not needed.

The submission service still exists, so I should:
1 - get rid of the 127.0.0.1:10026 but from master.cf.
2 - in master.cf change the submission line "-o 
content_filter=smtp-amavis:[127.0.0.1]:10024" to "-o 
content_filter=smtp-amavis:[127.0.0.1]:10028" (just to avoid 10026 for now)
3 - in amavis 50-user add:
       $inet_socket_port = [10024,10028];  # listen on two ports
       $interface_policy{'10028'} = 'ORIGINATING';

And that should do it?