Missing DKIM Record

# DKIM Private Key Generation - Cryptographic Foundation
openssl genrsa -out dkim_private.key 2048

# RSA Key Generation Parameters:
# genrsa          - Generate RSA private key using OpenSSL cryptographic library
# -out            - Output private key to specified file path (critical security asset)
# dkim_private.key - Private key filename (customize based on selector/domain)
# 2048            - Key size in bits (minimum recommended for email authentication)

# Key size security considerations:
# - 2048-bit: Industry standard, strong security, excellent compatibility
# - 3072-bit: Enhanced security for high-value domains (larger signatures)
# - 4096-bit: Maximum security but may cause DNS record size issues
# - 1024-bit: DEPRECATED - insufficient security against modern attacks

# Private key security requirements:
# - Generated on secure, trusted system with adequate entropy
# - Stored with restricted file permissions (owner read-only)
# - Protected by proper system access controls and monitoring
# - Never transmitted over unsecured channels or shared between systems

# DKIM Public Key Extraction - DNS Record Preparation
openssl rsa -in dkim_private.key -pubout -out dkim_public.key

# Public Key Extraction Parameters:
# rsa             - Process RSA key using OpenSSL RSA module
# -in             - Input private key file (source for public key extraction)
# dkim_private.key - Private key filename containing both public and private components
# -pubout         - Extract and output only the public key portion
# -out            - Output extracted public key to specified file path
# dkim_public.key - Public key filename (will be processed for DNS publication)

# Public key characteristics:
# - Contains mathematical public portion of RSA key pair
# - Safe for public distribution and DNS publication
# - Enables signature verification by receiving mail servers
# - Must match corresponding private key for successful authentication
# - PEM format output requires conversion for DNS TXT record format

# Public key usage in DKIM authentication:
# - Published in DNS TXT records for recipient mail server access
# - Used by receiving servers to verify DKIM signature authenticity
# - Enables cryptographic verification of message integrity and sender identity
# - Critical component enabling email authentication without private key exposure

# DKIM DNS Record Formatting - TXT Record Preparation
openssl rsa -in dkim_private.key -pubout -outform DER | \
  openssl base64 -A | \
  awk '{print "v=DKIM1; k=rsa; p=" $0}'

# DNS Record Formatting Pipeline:
# Step 1: openssl rsa -in dkim_private.key -pubout -outform DER
#   -outform DER: Output in Distinguished Encoding Rules (binary format)
#   - Required for proper base64 encoding without PEM headers/footers
#   - DER format ensures consistent binary representation for encoding
#   - Eliminates PEM ASCII armor that would interfere with DNS formatting

# Step 2: openssl base64 -A
#   base64: Encode binary DER data to base64 text representation
#   -A: No line wrapping (single continuous string)
#   - DNS TXT records require single-line base64 encoded public key data
#   - Line breaks would break DNS record parsing and DKIM validation
#   - Produces URL-safe base64 encoding compatible with DNS specifications

# Step 3: awk '{print "v=DKIM1; k=rsa; p=" $0}'
#   Creates properly formatted DKIM TXT record value:
#   - v=DKIM1: Version identifier (required first parameter)
#   - k=rsa: Key algorithm (RSA cryptography)
#   - p=: Public key data (base64 encoded from pipeline)
#   - Semicolon separation required for DKIM parameter parsing

# DKIM Enhanced Security Configuration - Advanced Parameters
openssl rsa -in dkim_private.key -pubout -outform DER | \
  openssl base64 -A | \
  awk '{print "v=DKIM1; h=sha256; k=rsa; t=s; s=email; p=" $0}'

# Enhanced DKIM Security Parameters:
# v=DKIM1: Version identifier (required for all DKIM implementations)
# h=sha256: Hash algorithm specification (SHA-256 recommended)
#   - SHA-256: Cryptographically secure, industry standard
#   - SHA-1: DEPRECATED due to collision vulnerabilities
#   - Stronger hash algorithms provide better signature integrity

# k=rsa: Key algorithm (RSA public key cryptography)
#   - RSA: Widely supported, proven security, excellent compatibility
#   - Alternative: Ed25519 (newer, more efficient, limited support)

# t=s: Testing mode configuration
#   - t=s (strict): Production mode, enforce all DKIM policies
#   - t=y (testing): Testing mode, lenient policy enforcement
#   - Strict mode recommended for production email security

# s=email: Service type restriction
#   - s=email: DKIM key used only for email authentication
#   - Prevents key reuse for other services (security best practice)
#   - Limits attack surface by restricting key usage scope

# Critical Private Key Security Implementation:
chmod 600 dkim_private.key              # Restrict to owner read/write only
chown mail:mail dkim_private.key         # Set proper mail daemon ownership

# File Permission Security (chmod 600):
# - 6 (owner): read (4) + write (2) = full access for key owner
# - 0 (group): no permissions for group members
# - 0 (other): no permissions for other users
# - Prevents unauthorized private key access and signature forgery

# Ownership Security (chown mail:mail):
# - User: mail daemon user (typically 'mail', 'postfix', or 'opendkim')
# - Group: mail daemon group for proper process access
# - Ensures only mail server processes can access signing key
# - Critical for preventing privilege escalation and unauthorized signing

# DKIM Primary Production Key - Default Selector Configuration
default._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=MIIBIjAN..."

# Default Selector DNS Record Structure:
# default._domainkey.yourdomain.com - DNS record name format
#   default: Selector name (commonly used primary selector identifier)
#   _domainkey: DKIM service identifier (required DKIM specification prefix)
#   yourdomain.com: Your actual domain name (replace with real domain)

# TXT Record Value Components:
# "v=DKIM1; k=rsa; p=MIIBIjAN..."
#   v=DKIM1: DKIM version identifier (required first parameter)
#   k=rsa: Key algorithm (RSA cryptography, industry standard)
#   p=: Public key data (base64 encoded RSA public key from generation process)

# Production Key Characteristics:
# - Primary selector used by default mail server configuration
# - Handles majority of organizational email authentication
# - Should use strong 2048-bit or 3072-bit RSA keys for security
# - Requires regular monitoring for signature success rates
# - Critical for maintaining email deliverability and authentication
# - Must be protected against unauthorized modification or deletion

# DKIM Key Rotation Strategy - Time-Based Selector Management
rotate2024._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=MIGfMA0G..."

# Rotation Selector Strategy:
# rotate2024._domainkey.yourdomain.com - Time-based rotation selector
#   rotate2024: Year-based selector (clear rotation timeline)
#   Enables systematic annual or bi-annual key rotation
#   Provides clear chronological key management system

# Key Rotation Benefits:
# - Limits cryptographic exposure window through regular key changes
# - Reduces risk of private key compromise over time
# - Enables smooth transitions between old and new cryptographic keys
# - Supports security compliance requirements for key lifecycle management

# Rotation Implementation Process:
# 1. Generate new key pair with rotation selector (rotate2024)
# 2. Publish new DNS record alongside existing production key
# 3. Allow DNS propagation time (24-48 hours recommended)
# 4. Update mail server configuration to use rotation selector
# 5. Monitor email authentication success rates during transition
# 6. Remove old selector after successful transition period
# 7. Plan next rotation cycle using subsequent year selector

# Security Considerations:
# - Maintain both old and new keys during transition period
# - Monitor authentication failure rates during selector changes
# - Ensure all mail servers updated before removing old keys
# - Document rotation procedures for operational consistency

# DKIM Service Provider Integration - External Service Authentication
google._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=MIGfMA0G..."

# Service Provider Selector Configuration:
# google._domainkey.yourdomain.com - Google Workspace DKIM integration
#   google: Service provider selector (identifies Google Workspace service)
#   Enables delegation of DKIM key management to service provider
#   Required for Google Workspace email authentication functionality

# Service Provider Benefits:
# - Leverages provider's cryptographic key management expertise
# - Automatically updated by service provider for security maintenance
# - Eliminates manual key rotation responsibilities for external services
# - Provides service-specific authentication with clear attribution

# Common Service Provider Selectors:
# google._domainkey: Google Workspace / Gmail business accounts
# s1._domainkey: SendGrid email service integration  
# sm1._domainkey: Microsoft 365 / Office 365 email services
# mandrill._domainkey: Mailchimp Transactional Email (Mandrill)
# mailgun._domainkey: Mailgun email service integration
# amazonses._domainkey: Amazon Simple Email Service integration

# Service Provider Integration Requirements:
# - Follow provider-specific selector naming conventions
# - Use provider-generated public keys (never create manually)
# - Monitor provider notifications for key rotation schedules
# - Verify provider DKIM authentication through service dashboards
# - Maintain service provider DKIM configuration documentation

# Mixed Environment Management:
# - Internal mail servers use organizational selectors (default, rotate2024)
# - External services use provider-specific selectors (google, s1)
# - Both types can coexist safely on same domain
# - Different selectors enable clear service attribution in email headers

# DKIM DNS Record Basic Verification - System Resolver
dig TXT default._domainkey.yourdomain.com

# DNS Query Command Structure:
# dig              - Domain Information Groper (DNS lookup utility)
# TXT              - DNS record type (TXT records contain DKIM public keys)
# default._domainkey.yourdomain.com - Full DKIM selector DNS name
#   default: Selector name (matches mail server configuration)
#   _domainkey: DKIM service identifier (required DKIM prefix)
#   yourdomain.com: Your domain name (replace with actual domain)

# Expected Response Format:
# ;; ANSWER SECTION:
# default._domainkey.yourdomain.com. 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBg..."
#
# Response Components Analysis:
# - Record name: default._domainkey.yourdomain.com.
# - TTL: 3600 (seconds, DNS cache lifetime)
# - Class: IN (Internet class)
# - Type: TXT (text record type)
# - Value: "v=DKIM1; k=rsa; p=..." (DKIM public key data)

# Verification Success Indicators:
# - ANSWER SECTION contains requested record
# - Record value starts with "v=DKIM1"
# - Public key data (p=) contains base64 encoded key
# - No NXDOMAIN or SERVFAIL errors reported

# DKIM Multi-Resolver Verification - Global Accessibility Testing
dig @8.8.8.8 TXT default._domainkey.yourdomain.com     # Google Public DNS
dig @1.1.1.1 TXT default._domainkey.yourdomain.com     # Cloudflare Public DNS

# Public DNS Resolver Testing Strategy:
# @8.8.8.8 - Google Public DNS (primary resolver)
#   - Global coverage with extensive caching infrastructure
#   - Used by many email providers for DKIM validation
#   - Provides reliable baseline for record availability testing

# @1.1.1.1 - Cloudflare Public DNS (alternative resolver) 
#   - Fast global DNS resolution network
#   - Different caching policies from Google DNS
#   - Validates record consistency across resolver networks

# Additional Public Resolvers (comprehensive testing):
dig @9.9.9.9 TXT default._domainkey.yourdomain.com     # Quad9 DNS (security-focused)
dig @208.67.222.222 TXT default._domainkey.yourdomain.com  # OpenDNS (Cisco)

# Multi-Resolver Benefits:
# - Detects DNS propagation inconsistencies across resolver networks
# - Identifies caching delays that might affect email authentication
# - Ensures DKIM records available from major email provider resolvers
# - Validates global DNS record consistency for international email delivery

# Troubleshooting Different Resolver Results:
# - Consistent results: Proper DNS propagation completed
# - Inconsistent results: DNS propagation still in progress (wait 24-48h)
# - NXDOMAIN errors: Record not published or selector name incorrect
# - TIMEOUT errors: DNS server issues or network connectivity problems

# DKIM Advanced DNS Diagnostics - Comprehensive Record Analysis
dig +trace TXT default._domainkey.yourdomain.com       # Full DNS resolution path
dig +short TXT default._domainkey.yourdomain.com       # Simplified output (record value only)
dig +noall +answer TXT default._domainkey.yourdomain.com  # Clean answer format

# Advanced DNS Query Options:
# +trace: Show complete DNS resolution path from root servers
#   - Displays authoritative name server chain
#   - Identifies DNS delegation issues or misconfigurations
#   - Useful for troubleshooting DNS resolution failures

# +short: Display only the record value (simplified output)
#   - "v=DKIM1; k=rsa; p=MIIBIjANBg..."
#   - Clean format for automated processing or validation scripts
#   - Eliminates DNS query metadata for focused record inspection

# +noall +answer: Show only answer section (clean format)
#   - Removes query header and statistics information
#   - Focuses on actual DNS record content
#   - Professional format for documentation and reporting

# DKIM Record Content Validation:
# nslookup -type=TXT default._domainkey.yourdomain.com
#   Alternative DNS lookup tool (Windows/Unix compatibility)
#   Useful when dig command not available on system

# Record Length and Format Verification:
dig TXT default._domainkey.yourdomain.com | grep -E "v=DKIM1"
#   Filters output to show only DKIM records
#   Validates proper DKIM record format and version
#   Useful for automated monitoring and validation scripts

# /etc/opendkim.conf - OpenDKIM Daemon Configuration
Domain yourdomain.com                               # Primary domain for email signing
KeyFile /etc/opendkim/keys/default.private         # DKIM private key file path
Selector default                                    # DKIM selector name (matches DNS record)

# Core OpenDKIM Configuration Parameters:
# Domain: Specifies the domain name for which emails will be signed
#   - Must match the From: header domain in outgoing emails
#   - Can specify multiple domains using KeyTable/SigningTable (advanced)
#   - Critical for proper DKIM signature domain identification

# KeyFile: Path to DKIM private signing key
#   - Must be readable by OpenDKIM daemon user (typically 'opendkim')
#   - File permissions should be 600 (owner read/write only)
#   - Contains RSA private key generated during key creation process
#   - Critical security component - never expose or share this file

# Selector: DKIM selector identifier for DNS record matching
#   - Must match the selector used in DNS TXT record publication
#   - default._domainkey.yourdomain.com corresponds to selector "default"
#   - Enables multiple DKIM keys per domain for rotation and service separation
#   - Used by receiving servers to locate correct public key in DNS

# OpenDKIM Milter Interface Configuration - Postfix Communication
Socket inet:8891@localhost                         # TCP socket for Postfix milter communication

# Milter Socket Configuration:
# Socket inet:8891@localhost - TCP socket configuration
#   inet: Internet socket type (TCP/IP communication)
#   8891: Port number for OpenDKIM daemon listening
#   localhost: Bind to local interface only (security best practice)
#   
# Alternative socket configurations:
# Socket unix:/var/run/opendkim/opendkim.sock     # Unix domain socket (faster)
# Socket inet:8891@0.0.0.0                       # All interfaces (multi-server setup)

# Socket Security Considerations:
# - TCP socket: Cross-system communication, easier debugging
# - Unix socket: Faster performance, local system only
# - localhost binding: Prevents external milter access
# - Port selection: Avoid conflicts with other services (8891 is standard)

# Postfix Integration Requirements:
# - Postfix must connect to same socket configuration
# - Socket must be accessible to postfix user/group
# - Network connectivity required for TCP socket communication
# - Proper firewall rules if using non-localhost binding

# OpenDKIM Advanced Security and Performance Settings
Canonicalization relaxed/simple                    # Header/body canonicalization modes
SignatureAlgorithm rsa-sha256                      # Cryptographic signature algorithm
MinimumKeyBits 1024                                # Minimum acceptable key size (2048 recommended)

# Canonicalization Configuration (relaxed/simple):
# Header Canonicalization: relaxed
#   - Normalizes whitespace in email headers
#   - Tolerates minor header modifications during transit
#   - Improves signature survival through mail infrastructure
#   - Recommended for production environments with complex mail routing

# Body Canonicalization: simple
#   - Preserves email body exactly as sent
#   - No whitespace normalization applied to message content
#   - Provides stronger integrity protection for message body
#   - Balance between signature robustness and content protection

# SignatureAlgorithm rsa-sha256:
# - RSA: Public key cryptographic algorithm (industry standard)
# - SHA-256: Cryptographic hash function (stronger than SHA-1)
# - Provides strong signature security and wide compatibility
# - Recommended over deprecated SHA-1 algorithm

# MinimumKeyBits 1024:
# - Minimum acceptable DKIM key size for signature validation
# - 1024: Absolute minimum (deprecated for new implementations)
# - 2048: Current industry standard recommendation
# - 3072/4096: Enhanced security for high-value domains
# - Rejects signatures from keys smaller than specified size

# OpenDKIM Trust Configuration and Postfix Integration
ExternalIgnoreList refile:/etc/opendkim/TrustedHosts  # External trusted host list
InternalHosts refile:/etc/opendkim/TrustedHosts       # Internal network configuration
LogWhy yes                                            # Detailed logging for troubleshooting

# Trust Configuration Files:
# /etc/opendkim/TrustedHosts - Trusted host configuration
#   127.0.0.1     # Localhost (always trusted)
#   192.168.1.0/24 # Internal network CIDR (don't sign internal mail)
#   10.0.0.0/8    # Private network ranges
#   yourdomain.com # Domain-based trust (sign emails from domain)

# Trust Configuration Benefits:
# - ExternalIgnoreList: External hosts not requiring DKIM signatures
# - InternalHosts: Internal networks excluded from signing requirements
# - Prevents unnecessary DKIM signing for internal mail routing
# - Reduces processing overhead for internal email communication

# Logging Configuration:
# LogWhy yes: Enable detailed signature verification logging
#   - Provides troubleshooting information for signature failures
#   - Records DKIM validation results and failure reasons
#   - Essential for debugging authentication issues
#   - Logs written to system syslog facility

# /etc/postfix/main.cf - Postfix Milter Integration
smtpd_milters = inet:localhost:8891                # Inbound mail filtering milter
non_smtpd_milters = inet:localhost:8891            # Outbound mail signing milter (critical)
milter_default_action = accept                     # Default action when milter unavailable
milter_protocol = 6                                # Milter protocol version (latest)

# Postfix Milter Configuration:
# smtpd_milters: Inbound mail processing (SMTP daemon)
#   - Processes incoming email through OpenDKIM for validation
#   - Enables DKIM signature verification for received messages
#   - Optional but useful for comprehensive email security

# non_smtpd_milters: Outbound mail processing (critical for signing)
#   - Processes outgoing email for DKIM signature application
#   - REQUIRED for DKIM signature generation on outbound messages
#   - Must match OpenDKIM socket configuration exactly

# milter_default_action accept: Failsafe behavior
#   - Accept email if OpenDKIM milter unavailable
#   - Prevents mail delivery failures during OpenDKIM maintenance
#   - Alternative: reject (more secure but risks mail loss)

# milter_protocol 6: Latest milter protocol version
#   - Ensures compatibility with modern OpenDKIM features
#   - Provides optimal communication efficiency
#   - Required for advanced milter functionality