1 Install OpenDKIM

Enable EPEL and install OpenDKIM and its utilities:

Verify the installation:

2 Create the DKIM Key Directories

Create a separate directory for every domain that will send email. For example:

The resulting structure should look like:

3 Generate a DKIM Key for Each Domain

Generate a separate 2048-bit RSA key pair for each domain. The selector used in this example is mail2026.

cylinux.com

example.com

example.net

Each command creates two files:

4 Configure the KeyTable

Edit:

Add one entry for every domain:

The format is:

This configuration tells OpenDKIM which private key must be used for each domain.

5 Configure the SigningTable

Edit:

Add:

This determines which DKIM key is used according to the sender's domain.

6 Configure OpenDKIM

Edit:

Make sure the following settings are present:

Mode sv enables both DKIM signing and verification.

7 Configure TrustedHosts

Edit:

At minimum, include:

If mail is submitted from a trusted internal network, the appropriate internal subnet can also be added. For example:

8 Set File Permissions

OpenDKIM needs permission to read the private keys, while the private keys themselves should be protected from other users.

Verify:

9 Publish the DKIM Public Keys in DNS

Display the generated public key for a domain:

The output will contain a TXT record similar to:

Create a DNS TXT record for:

Repeat the process for every domain:

10 Verify the DNS Record

Use:

or:

The response should contain a value beginning with:

11 Test the DKIM Key

Before connecting OpenDKIM to Sendmail, test the DNS record and private key:

A successful test should report:

Repeat for the other domains:

12 Connect OpenDKIM to Sendmail

Edit:

Add the OpenDKIM milter configuration:

This tells Sendmail to pass outgoing messages through the OpenDKIM milter local socket.

13 Rebuild Sendmail Configuration

Rebuild the Sendmail configuration:

Alternatively, the configuration can be generated directly with:

14 Start and Enable OpenDKIM

Check the services:

15 Send a Test Email

Send an email using one of your configured domains:

Inspect the headers of the received message. You should see a header similar to:

For an email sent from another configured domain, the d= and s= values should correspond to that domain and selector.

Multi-Domain Configuration

Using the same selector name for different domains is acceptable because the selector is evaluated within the domain. Each domain should still have its own key pair.

DKIM Key Rotation

DKIM keys do not have a built-in expiration date. Nevertheless, periodic key rotation is recommended as a security practice.

For example, a future selector can be introduced:

The general rotation process is:

1. Generate a new key pair with a new selector.
2. Publish the new public key in DNS.
3. Change OpenDKIM to use the new selector.
4. Keep the old public key in DNS temporarily.
5. Remove the old DNS record after the transition period.

Important: DKIM DNS Record vs. DKIM Signing

A DKIM TXT record in DNS does not force a mail server to sign messages. It only publishes the public key used to verify messages signed with that selector.

If OpenDKIM is temporarily unavailable, outgoing mail may be sent without a DKIM-Signature header. Whether that affects delivery depends on the receiving system and the domain's SPF and DMARC configuration.

Recommended Final Configuration

A clean multi-domain installation should have a structure similar to: