opendkim(8)
OpenDKIM is a milter-based implementation of DKIM (DomainKeys Identified Mail) signing and verification for sendmail and other mail transfer agents.
Synopsis
opendkim [OPTIONS]Description
OpenDKIM is a cryptographic authentication system that allows mail senders to prove ownership of a message by signing it with a private key, while recipients verify the signature using a public key published in DNS. It integrates with MTAs like sendmail and Postfix via the milter protocol to sign outgoing mail and verify incoming mail.
The daemon reads its configuration from /etc/opendkim.conf and manages DKIM signing based on domain policies, key management, and signature verification rules. It runs as a background service listening on a socket for connections from the MTA.
Common options
| Flag | What it does |
|---|---|
-c FILE | Configuration file path (default: /etc/opendkim.conf) |
-d DOMAIN | Specify domain to sign for (overrides configuration) |
-l | Operate in local mode, do not fork to background |
-p SOCKET | Milter socket to listen on (e.g., inet:[email protected]) |
-P PIDFILE | Write process ID to specified file |
-t | Test configuration and exit without running daemon |
-u USERID | Run daemon as specified user (default: opendkim) |
-v | Verbose logging to syslog |
-x | Sign all mail (ignore From: header domain restrictions) |
Examples
Start OpenDKIM daemon listening on localhost port 8891, running as opendkim user
opendkim -c /etc/opendkim.conf -p inet:[email protected] -u opendkimTest the configuration file for syntax errors without starting the daemon
opendkim -t -c /etc/opendkim.confRun OpenDKIM in foreground with verbose logging for debugging
opendkim -l -v -c /etc/opendkim.confStart the OpenDKIM service and enable it for automatic startup
systemctl start opendkim && systemctl enable opendkimCheck recent DKIM signing/verification messages in mail log
grep -i dkim /var/log/maillog | tail -20Generate DKIM keypair for example.com domain (separate utility)
opendkim-genkey -D /etc/opendkim/keys/example.com -d example.com -s default