Important Records for Mail Domain Name

When you have a domain, for example, yourdomain.com, you can create your email address at that domain name like yourname@yourdomain.com. Several domain name records which I consider to be important for mail domain are:

1. MX Record
Of course, it assigns a domain where the mail exchange server is located. For example:

Name	Priority	Type	Data
yourdomain.com	10	MX	mx.yourdomain.com

2. SPF Record
SPF is a spam and phishing scam fighting method that uses DNS SPF records to define which hosts are permitted to send e-mails for a domain. See http://www.openspf.org. For example:

Name	Type	Data
yourdomain.com	TXT	"v=spf1 mx mx:yourdomain.com -all"

This configuration means emails sent from all servers defined in the MX record of yourdomain.com are permitted by the sender organization

3. DKIM Record
DKIM allows an organization to take responsibility for a message in a way that can be verified by a recipient. DKIM defines a domain-level digital signature authentication framework for email through the use of public-key cryptography and using the domain name service as its key server technology (more info).  There are some steps to sign DKIM signature on the mail server using amavisd (in latest Ubuntu its name is amavisd-new).

1) Check existing keys.

$ amavisd-new showkeys

2) Generate new key for new domain.

$ amavisd-new genrsa /var/lib/dkim/yournewdomain.com.pem 1024
$ chown amavis:amavis /var/lib/dkim/yournewdomain.com.pem
$ chmod 0400 /var/lib/dkim/yournewdomain.com.pem

3) Setup amavisd configuration. In Ubuntu, it's located at /etc/amavis/conf.d/50-user.

Find:

dkim_key('yourdomain.com', "dkim", "/var/lib/dkim/yourdomain.com.pem");

Add:

dkim_key('yournewdomain.com', "dkim", "/var/lib/dkim/yournewdomain.com.pem");

Find:

@dkim_signature_options_bysender_maps = ( {
    ...
    "yourdomain.com"  => { d => "yourdomain.com", a => 'rsa-sha256', ttl => 10*24*3600 },
    ...
});

Add:

@dkim_signature_options_bysender_maps = ( {
    ...
    "yourdomain.com"  => { d => "yourdomain.com", a => 'rsa-sha256', ttl => 10*24*3600 },
    "yournewdomain.com"  => { d => "yournewdomain.com", a => 'rsa-sha256', ttl => 10*24*3600 },
    ...
});

Actually, you can also use an existing key and don't need to generate a new key by mapping the new domain to use an existing key.

    "yournewdomain.com"  => { d => "yourdomain.com", a => 'rsa-sha256', ttl => 10*24*3600 },

Or, you can also assign a key for all domains.

dkim_key('*', "dkim", "/var/lib/dkim/yourdomain.com.pem");

Then restart amavisd.

4) Recheck existing keys.

$ amavisd-new showkeys

Copy the value part v=DKIM1; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDYArsr2BKbdhv9efugBy... and remove any quotes and line breaks.

5) Update DNS record for new DKIM information. (Domain providers can take a while for updating its records)

Name	Type	Data
dkim._domainkey.yourdomain.com	TXT	v=DKIM1; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBi...

6) Validate DNS record using amavisd. If it returns pass, it works.

$ amavisd-new testkeys

7) Verify using other tools.

$ dig -t txt dkim._domainkey.yourdomain.com
$ nslookup -type=txt dkim._domainkey.yourdomain.com