0

I am having an issue with not finding the public key of DKIM. I am using a local DNS (BIND), so there isn’t a problem with propagating. I just copypasted the output of given generated public key into my DNS Zone

user@test:~$ sudo opendkim-testkey -d domain.com -s default -vvv
opendkim-testkey: using default configfile /etc/opendkim.conf
opendkim-testkey: checking key 'default._domainkey.domain.com'
opendkim-testkey: 'default._domainkey.domain.com' record not found

When I use dig, I can find the TXT record:

user@test:~$ dig TXT default._domainkey.domain.com

;; ANSWER SECTION:
default._domainkey.domain.com. 604800 IN TXT "v=DKIM1; h=sha256; k=rsa; " "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7CxWakZ+6jE5xpwlwV1ifu++ogiKUdo+6ByIVpmsZul4KM+TN7XfD8GeqXsQYWAwfXlFO+DWwTzASfSxcl3FqE8rXt2hfDTjz/9lGAvz3qJdSXSE3GarPzBxSmuEp8kjh9JAxgRP9CCdWhsTpfakOUbh3fzlIskAUeNtrv1gUMFrS8TQnjADvkd7sRkv5gwH0HmKNRtAX/PSJg" "QGgULTLraVB9zPc1dPzxt7RieW+bg/6Mnf0DN6E6VYUZPNGktNB2cjLSKCNQW2FU2z+TU3MRFu09u7PFbm28HA38mBaMZfC9+3l/trKtr4NkF17mKBmPoW9wfWLm1gk+4mh1L4oQIDAQAB"

I made sure I have the right selector and even tried this

user@test:~$ sudo opendkim-testkey -d domain.com -s default -vvv -k default.private
opendkim-testkey: using default configfile /etc/opendkim.conf
opendkim-testkey: checking key 'default._domainkey.domain.com'
opendkim-testkey: 'default._domainkey.domain.com' record not found

Any idea what went wrong?

stefPan
  • 21
  • 2
  • I'm not familiar with `opendkim-testkey` - does it use your local resolver for handling DNS queries or does it do its own thing from the root servers? – roaima May 04 '22 at 20:02
  • It's my local resolver with no connection to the internet. Just an offline server with mail and DNS. – stefPan May 04 '22 at 20:15
  • That's not quite what I asked. Does `opendkim-testkey` also use your local resolver, or is the reason is failing because it's trying to start with the public root servers? – roaima May 04 '22 at 20:16
  • Since that dig command resolves to a correct local TXT record, I think it is set correctly to the local resolver. I even checked resolv.conf – stefPan May 04 '22 at 20:43
  • 1
    Sorry, I am not trying to avoid your question. I think I am not rather understanding it to respond properly. I don't know if `opendkim-testkey` is using my local resolver. I just run it on the same machine where my DNS is set on local. I don't see an option where I could set the resolver. – stefPan May 04 '22 at 21:50
  • Do you have an entry in your `opendkim.conf` that defines `Nameservers`? – roaima May 04 '22 at 21:59
  • 1
    I did not. But I added it in my conf. With the same result of record not found – stefPan May 04 '22 at 22:30

1 Answers1

0

What really helped was concatenating it into one string, putting it into an online DNS Service which accepts long strings. When the TXT record is propagated online, I retrieved two strings from the public key. When I put it into my local DNS, opendkim-testkey gets a successful result.

stefPan
  • 21
  • 2
  • 1
    I don't understand you. Are you saying you split the key into two parts, and that's why it wasn't working properly? – roaima May 05 '22 at 16:38