OpenDKIM: opendkim/opendkim.conf.sample

"Fossies" - the Fresh Open Source Software Archive

Member "opendkim-2.10.3/opendkim/opendkim.conf.sample" (11 May 2015, 21800 Bytes) of package /linux/misc/opendkim-2.10.3.tar.gz:

As a special service "Fossies" has tried to format the requested text file into HTML format (style: standard) with prefixed line numbers. Alternatively you can here view or download the uninterpreted source code file. See also the last Fossies "Diffs" side-by-side code changes report for "opendkim.conf.sample":

2.10.1_vs_2.10.2.

1 ## 2 ## opendkim.conf -- configuration file for OpenDKIM filter 3 ## 4 ## Copyright (c) 2010-2015, The Trusted Domain Project. All rights reserved. 5 ## 6 7 ## 8 ## For settings that refer to a "dataset", see the opendkim(8) man page. 9 ## 10 11 ## DEPRECATED CONFIGURATION OPTIONS 12 ## 13 ## The following configuration options are no longer valid. They should be 14 ## removed from your existing configuration file to prevent potential issues. 15 ## Failure to do so may result in opendkim being unable to start. 16 ## 17 ## Removed in 2.10.0: 18 ## AddAllSignatureResults 19 ## ADSPAction 20 ## ADSPNoSuchDomain 21 ## BogusPolicy 22 ## DisableADSP 23 ## LDAPSoftStart 24 ## LocalADSP 25 ## NoDiscardableMailTo 26 ## On-PolicyError 27 ## SendADSPReports 28 ## UnprotectedPolicy 29 30 ## CONFIGURATION OPTIONS 31 32 ## AllowSHA1Only { yes | no } 33 ## default "no" 34 ## 35 ## By default, the filter will refuse to start if support for SHA256 is 36 ## not available since this violates the strong recommendations of 37 ## RFC6376 Section 3.3, which says: 38 ## 39 ## "Verifiers MUST implement both rsa-sha1 and rsa-sha256. Signers MUST 40 ## implement and SHOULD sign using rsa-sha256." 41 ## 42 ## This forces that violation to be explicitly selected by the administrator. 43 44 # AllowSHA1Only no 45 46 ## AlwaysAddARHeader { yes | no } 47 ## default "no" 48 ## 49 ## Add an "Authentication-Results:" header even to unsigned messages 50 ## from domains with no "signs all" policy. The reported DKIM result 51 ## will be "none" in such cases. Normally unsigned mail from non-strict 52 ## domains does not cause the results header to be added. 53 54 # AlwaysAddARHeader no 55 56 ## AuthservID string 57 ## default (local host name) 58 ## 59 ## Defines the "authserv-id" token to be used when generating 60 ## Authentication-Results headers after message verification. 61 62 # AuthservID example.com 63 64 ## AuthservIDWithJobID 65 ## default "no" 66 ## 67 ## Appends a "/" followed by the MTA's job ID to the "authserv-id" token 68 ## when generating Authentication-Results headers after message verification. 69 70 # AuthservIDWithJobId no 71 72 ## AutoRestart { yes | no } 73 ## default "no" 74 ## 75 ## Indicate whether or not the filter should arrange to restart automatically 76 ## if it crashes. 77 78 # AutoRestart No 79 80 ## AutoRestartCount n 81 ## default 0 82 ## 83 ## Sets the maximum automatic restart count. After this number of 84 ## automatic restarts, the filter will give up and terminate. A value of 0 85 ## implies no limit. 86 87 # AutoRestartCount 0 88 89 ## AutoRestartRate n/t[u] 90 ## default (none) 91 ## 92 ## Sets the maximum automatic restart rate. See the opendkim.conf(5) 93 ## man page for the format of this parameter. 94 95 # AutoRestartRate n/tu 96 97 ## Background { yes | no } 98 ## default "yes" 99 ## 100 ## Indicate whether or not the filter should run in the background. 101 102 # Background Yes 103 104 ## BaseDirectory path 105 ## default (none) 106 ## 107 ## Causes the filter to change to the named directory before beginning 108 ## operation. Thus, cores will be dumped here and configuration files 109 ## are read relative to this location. 110 111 # BaseDirectory /var/run/opendkim 112 113 ## BodyLengthDB dataset 114 ## default (none) 115 ## 116 ## A data set that is checked against envelope recipients to see if a 117 ## body length tag should be included in the generated signature. 118 ## This has security implications; see opendkim.conf(5) for details. 119 120 # BodyLengthDB dataset 121 122 ## Canonicalization hdrcanon[/bodycanon] 123 ## default "simple/simple" 124 ## 125 ## Select canonicalizations to use when signing. If the "bodycanon" is 126 ## omitted, "simple" is used. Valid values for each are "simple" and 127 ## "relaxed". 128 129 # Canonicalization simple/simple 130 131 ## ClockDrift n 132 ## default 300 133 ## 134 ## Specify the tolerance range for expired signatures or signatures 135 ## which appear to have timestamps in the future, allowing for clock 136 ## drift. 137 138 # ClockDrift 300 139 140 ## Diagnostics { yes | no } 141 ## default "no" 142 ## 143 ## Specifies whether or not signatures with header diagnostic tags should 144 ## be generated. 145 146 # Diagnostics No 147 148 ## DNSTimeout n 149 ## default 10 150 ## 151 ## Specify the time in seconds to wait for replies from the nameserver when 152 ## requesting keys or signing policies. 153 154 # DNSTimeout 10 155 156 ## Domain dataset 157 ## default (none) 158 ## 159 ## Specify for which domain(s) signing should be done. No default; must 160 ## be specified for signing. 161 162 Domain example.com 163 164 ## DomainKeysCompat { yes | no } 165 ## default "no" 166 ## 167 ## When enabled, backward compatibility with DomainKeys (RFC4870) key 168 ## records is enabled. Otherwise, such key records are considered to be 169 ## syntactically invalid. 170 171 # DomainKeysCompat no 172 173 ## DontSignMailTo dataset 174 ## default (none) 175 ## 176 ## Gives a list of recipient addresses or address patterns whose mail should 177 ## not be signed. 178 179 # DontSignMailTo addr1,addr2,... 180 181 ## EnableCoredumps { yes | no } 182 ## default "no" 183 ## 184 ## On systems which have support for such, requests that the kernel dump 185 ## core even though the process may change user ID during its execution. 186 187 # EnableCoredumps no 188 189 ## ExemptDomains dataset 190 ## default (none) 191 ## 192 ## A data set of domain names that are checked against the message sender's 193 ## domain. If a match is found, the message is ignored by the filter. 194 195 # ExemptDomains domain1,domain2,... 196 197 ## ExternalIgnoreList filename 198 ## 199 ## Names a file from which a list of externally-trusted hosts is read. 200 ## These are hosts which are allowed to send mail through you for signing. 201 ## Automatically contains 127.0.0.1. See man page for file format. 202 203 # ExternalIgnoreList filename 204 205 ## FixCRLF { yes | no } 206 ## 207 ## Requests that the library convert "naked" CR and LF characters to 208 ## CRLFs during canonicalization. The default is "no". 209 210 # FixCRLF no 211 212 ## IgnoreMalformedMail { yes | no } 213 ## default "no" 214 ## 215 ## Silently passes malformed messages without alteration. This includes 216 ## messages that fail the RequiredHeaders check, if enabled. The default is 217 ## to pass those messages but add an Authentication-Results field indicating 218 ## that they were malformed. 219 220 # IgnoreMalformedMail no 221 222 ## InternalHosts dataset 223 ## default "127.0.0.1" 224 ## 225 ## Names a file from which a list of internal hosts is read. These are 226 ## hosts from which mail should be signed rather than verified. 227 ## Automatically contains 127.0.0.1. 228 229 # InternalHosts dataset 230 231 ## KeepTemporaryFiles { yes | no } 232 ## default "no" 233 ## 234 ## If set, causes temporary files generated during message signing or 235 ## verifying to be left behind for debugging use. Not for normal operation; 236 ## can fill your disks quite fast on busy systems. 237 238 # KeepTemporaryFiles no 239 240 ## KeyFile filename 241 ## default (none) 242 ## 243 ## Specifies the path to the private key to use when signing. Ignored if 244 ## SigningTable and KeyTable are used. No default; must be specified for 245 ## signing if SigningTable/KeyTable are not in use. 246 247 KeyFile /var/db/dkim/example.private 248 249 ## KeyTable dataset 250 ## default (none) 251 ## 252 ## Defines a table that will be queried to convert key names to 253 ## sets of data of the form (signing domain, signing selector, private key). 254 ## The private key can either contain a PEM-formatted private key, 255 ## a base64-encoded DER format private key, or a path to a file containing 256 ## one of those. 257 258 # KeyTable dataset 259 260 ## LogWhy { yes | no } 261 ## default "no" 262 ## 263 ## If logging is enabled (see Syslog below), issues very detailed logging 264 ## about the logic behind the filter's decision to either sign a message 265 ## or verify it. The logic behind the decision is non-trivial and can be 266 ## confusing to administrators not familiar with its operation. A 267 ## description of how the decision is made can be found in the OPERATIONS 268 ## section of the opendkim(8) man page. This causes a large increase 269 ## in the amount of log data generated for each message, so it should be 270 ## limited to debugging use and not enabled for general operation. 271 272 # LogWhy no 273 274 ## MacroList macro[=value][,...] 275 ## 276 ## Gives a set of MTA-provided macros which should be checked to see 277 ## if the sender has been determined to be a local user and therefore 278 ## whether or not signing should be done. See opendkim.conf(5) for 279 ## more information. 280 281 # MacroList foo=bar,baz=blivit 282 283 ## MaximumHeaders n 284 ## 285 ## Disallow messages whose header blocks are bigger than "n" bytes. 286 ## Intended to detect and block a denial-of-service attack. The default 287 ## is 65536. A value of 0 disables this test. 288 289 # MaximumHeaders n 290 291 ## MaximumSignaturesToVerify n 292 ## (default 3) 293 ## 294 ## Verify no more than "n" signatures on an arriving message. 295 ## A value of 0 means "no limit". 296 297 # MaximumSignaturesToVerify n 298 299 ## MaximumSignedBytes n 300 ## 301 ## Don't sign more than "n" bytes of the message. The default is to 302 ## sign the entire message. Setting this implies "BodyLengths". 303 304 # MaximumSignedBytes n 305 306 ## MilterDebug n 307 ## 308 ## Request a debug level of "n" from the milter library. The default is 0. 309 310 # MilterDebug 0 311 312 ## Minimum n[% | +] 313 ## default 0 314 ## 315 ## Sets a minimum signing volume; one of the following formats: 316 ## n at least n bytes (or the whole message, whichever is less) 317 ## must be signed 318 ## n% at least n% of the message must be signed 319 ## n+ if a length limit was presented in the signature, no more than 320 ## n bytes may have been added 321 322 # Minimum n 323 324 ## MinimumKeyBits n 325 ## default 1024 326 ## 327 ## Causes the library not to accept signatures matching keys made of fewer 328 ## than the specified number of bits, even if they would otherwise pass 329 ## DKIM signing. 330 331 # MinimumKeyBits 1024 332 333 ## Mode [sv] 334 ## default sv 335 ## 336 ## Indicates which mode(s) of operation should be provided. "s" means 337 ## "sign", "v" means "verify". 338 339 # Mode sv 340 341 ## MTA dataset 342 ## default (none) 343 ## 344 ## Specifies a list of MTAs whos mail should always be signed rather than 345 ## verified. The "mtaname" is extracted from the DaemonPortOptions line 346 ## in effect. 347 348 # MTA name 349 350 ## MultipleSignatures { yes | no } 351 ## default no 352 ## 353 ## Allows multiple signatures to be added. If set to "true" and a SigningTable 354 ## is in use, all SigningTable entries that match the candidate message will 355 ## cause a signature to be added. Otherwise, only the first matching 356 ## SigningTable entry will be added, or only the key defined by Domain, 357 ## Selector and KeyFile will be added. 358 359 # MultipleSignatures no 360 361 ## MustBeSigned dataset 362 ## default (none) 363 ## 364 ## Defines a list of headers which, if present on a message, must be 365 ## signed for the signature to be considered acceptable. 366 367 # MustBeSigned header1,header2,... 368 369 ## Nameservers addr1[,addr2[,...]] 370 ## default (none) 371 ## 372 ## Provides a comma-separated list of IP addresses that are to be used when 373 ## doing DNS queries to retrieve DKIM keys, VBR records, etc. 374 ## These override any local defaults built in to the resolver in use, which 375 ## may be defined in /etc/resolv.conf or hard-coded into the software. 376 377 # Nameservers addr1,addr2,... 378 379 ## NoHeaderB { yes | no } 380 ## default "no" 381 ## 382 ## Suppresses addition of "header.b" tags on Authentication-Results 383 ## header fields. 384 385 # NoHeaderB no 386 387 ## OmitHeaders dataset 388 ## default (none) 389 ## 390 ## Specifies a list of headers that should always be omitted when signing. 391 ## Header names should be separated by commas. 392 393 # OmitHeaders header1,header2,... 394 395 ## On-... 396 ## 397 ## Specifies what to do when certain error conditions are encountered. 398 ## 399 ## See opendkim.conf(5) for more information. 400 401 # On-Default 402 # On-BadSignature 403 # On-DNSError 404 # On-InternalError 405 # On-NoSignature 406 # On-Security 407 # On-SignatureError 408 409 ## OversignHeaders dataset 410 ## default (none) 411 ## 412 ## Specifies a set of header fields that should be included in all signature 413 ## header lists (the "h=" tag) once more than the number of times they were 414 ## actually present in the signed message. See opendkim.conf(5) for more 415 ## information. 416 417 # OverSignHeaders header1,header2,... 418 419 ## PeerList dataset 420 ## default (none) 421 ## 422 ## Contains a list of IP addresses, CIDR blocks, hostnames or domain names 423 ## whose mail should be neither signed nor verified by this filter. See man 424 ## page for file format. 425 426 # PeerList filename 427 428 ## PidFile filename 429 ## default (none) 430 ## 431 ## Name of the file where the filter should write its pid before beginning 432 ## normal operations. 433 434 # PidFile filename 435 436 ## POPDBFile dataset 437 ## default (none) 438 ## 439 ## Names a database which should be checked for "POP before SMTP" records 440 ## as a form of authentication of users who may be sending mail through 441 ## the MTA for signing. Requires special compilation of the filter. 442 ## See opendkim.conf(5) for more information. 443 444 # POPDBFile filename 445 446 ## Quarantine { yes | no } 447 ## default "no" 448 ## 449 ## Indicates whether or not the filter should arrange to quarantine mail 450 ## which fails verification. Intended for diagnostic use only. 451 452 # Quarantine No 453 454 ## QueryCache { yes | no } 455 ## default "no" 456 ## 457 ## Instructs the DKIM library to maintain its own local cache of keys and 458 ## policies retrieved from DNS, rather than relying on the nameserver for 459 ## caching service. Useful if the nameserver being used by the filter is 460 ## not local. The filter must be compiled with the QUERY_CACHE flag to enable 461 ## this feature, since it adds a library dependency. 462 463 # QueryCache No 464 465 ## RedirectFailuresTo address 466 ## default (none) 467 ## 468 ## Redirects signed messages to the specified address if none of the 469 ## signatures present failed to verify. 470 471 # RedirectFailuresTo postmaster@example.com 472 473 ## RemoveARAll { yes | no } 474 ## default "no" 475 ## 476 ## Remove all Authentication-Results: headers on all arriving mail. 477 478 # RemoveARAll No 479 480 ## RemoveARFrom dataset 481 ## default (none) 482 ## 483 ## Remove all Authentication-Results: headers on all arriving mail that 484 ## claim to have been added by hosts listed in this parameter. The list 485 ## should be comma-separated. Entire domains may be specified by preceding 486 ## the dopmain name by a single dot (".") character. 487 488 # RemoveARFrom host1,host2,.domain1,.domain2,... 489 490 ## RemoveOldSignatures { yes | no } 491 ## default "no" 492 ## 493 ## Remove old signatures on messages, if any, when generating a signature. 494 495 # RemoveOldSignatures No 496 497 ## ReportAddress addr 498 ## default (executing user)@(hostname) 499 ## 500 ## Specifies the sending address to be used on From: headers of outgoing 501 ## failure reports. By default, the e-mail address of the user executing 502 ## the filter is used. 503 504 # ReportAddress "DKIM Error Postmaster" <postmaster@example.com> 505 506 ## ReportBccAddress addr 507 ## default (none) 508 ## 509 ## Specifies additional recipient address(es) to receive outgoing failure 510 ## reports. 511 512 # ReportBccAddress postmaster@example.com, john@example.com 513 514 ## RequiredHeaders { yes | no } 515 ## default no 516 ## 517 ## Rejects messages which don't conform to RFC5322 header count requirements. 518 519 # RequiredHeaders No 520 521 ## RequireSafeKeys { yes | no } 522 ## default yes 523 ## 524 ## Refuses to use key files that appear to have unsafe permissions. 525 526 # RequireSafeKeys Yes 527 528 ## ResignAll { yes | no } 529 ## default no 530 ## 531 ## Where ResignMailTo triggers a re-signing action, this flag indicates 532 ## whether or not all mail should be signed (if set) versus only verified 533 ## mail being signed (if not set). 534 535 # ResignAll No 536 537 ## ResignMailTo dataset 538 ## default (none) 539 ## 540 ## Checks each message recipient against the specified dataset for a 541 ## matching record. The full address is checked in each case, then the 542 ## hostname, then each domain preceded by ".". If there is a match, the 543 ## value returned is presumed to be the name of a key in the KeyTable 544 ## (if defined) to be used to re-sign the message in addition to 545 ## verifying it. If there is a match without a KeyTable, the default key 546 ## is applied. 547 548 # ResignMailTo dataset 549 550 ## ResolverConfiguration string 551 ## 552 ## Passes arbitrary configuration data to the resolver. For the stock UNIX 553 ## resolver, this is ignored; for Unbound, it names a resolv.conf(5)-style 554 ## file that should be read for configuration information. 555 556 # ResolverConfiguration string 557 558 ## ResolverTracing { yes | no } 559 ## 560 ## Requests enabling of resolver trace features, if available. The effect 561 ## of setting this flag depends on how trace features, if any, are implemented 562 ## in the resolver in use. Currently only effective when used with the 563 ## OpenDKIM asynchronous resolver. 564 565 # ResolverTracing no 566 567 ## Selector name 568 ## 569 ## The name of the selector to use when signing. No default; must be 570 ## specified for signing. 571 572 Selector my-selector-name 573 574 ## SenderHeaders dataset 575 ## default (none) 576 ## 577 ## Overrides the default list of headers that will be used to determine 578 ## the sending domain when deciding whether to sign the message and with 579 ## with which key(s). See opendkim.conf(5) for details. 580 581 # SenderHeaders From 582 583 ## SendReports { yes | no } 584 ## default "no" 585 ## 586 ## Specifies whether or not the filter should generate report mail back 587 ## to senders when verification fails and an address for such a purpose 588 ## is provided. See opendkim.conf(5) for details. 589 590 # SendReports No 591 592 ## SignatureAlgorithm signalg 593 ## default "rsa-sha256" 594 ## 595 ## Signature algorithm to use when generating signatures. Must be either 596 ## "rsa-sha1" or "rsa-sha256". 597 598 # SignatureAlgorithm rsa-sha256 599 600 ## SignatureTTL seconds 601 ## default "0" 602 ## 603 ## Specifies the lifetime in seconds of signatures generated by the 604 ## filter. A value of 0 means no expiration time is included in the 605 ## signature. 606 607 # SignatureTTL 0 608 609 ## SignHeaders dataset 610 ## default (none) 611 ## 612 ## Specifies the list of headers which should be included when generating 613 ## signatures. The string should be a comma-separated list of header names. 614 ## See the opendkim.conf(5) man page for more information. 615 616 # SignHeaders header1,header2,... 617 618 ## SigningTable dataset 619 ## default (none) 620 ## 621 ## Defines a dataset that will be queried for the message sender's address 622 ## to determine which private key(s) (if any) should be used to sign the 623 ## message. The sender is determined from the value of the sender 624 ## header fields as described with SenderHeaders above. The key for this 625 ## lookup should be an address or address pattern that matches senders; 626 ## see the opendkim.conf(5) man page for more information. The value 627 ## of the lookup should return the name of a key found in the KeyTable 628 ## that should be used to sign the message. If MultipleSignatures 629 ## is set, all possible lookup keys will be attempted which may result 630 ## in multiple signatures being applied. 631 632 # SigningTable filename 633 634 ## SingleAuthResult { yes | no} 635 ## default "no" 636 ## 637 ## When DomainKeys verification is enabled, multiple Authentication-Results 638 ## will be added, one for DK and one for DKIM. With this enabled, only 639 ## a DKIM result will be reported unless DKIM failed but DK passed, in which 640 ## case only a DK result will be reported. 641 642 # SingleAuthResult no 643 644 ## SMTPURI uri 645 ## 646 ## Specifies a URI (e.g., "smtp://localhost") to which mail should be sent 647 ## via SMTP when notifications are generated. 648 649 # Socket smtp://localhost 650 651 ## Socket socketspec 652 ## 653 ## Names the socket where this filter should listen for milter connections 654 ## from the MTA. Required. Should be in one of these forms: 655 ## 656 ## inet:port@address to listen on a specific interface 657 ## inet:port to listen on all interfaces 658 ## local:/path/to/socket to listen on a UNIX domain socket 659 660 Socket inet:port@localhost 661 662 ## SoftwareHeader { yes | no } 663 ## default "no" 664 ## 665 ## Add a DKIM-Filter header field to messages passing through this filter 666 ## to identify messages it has processed. 667 668 # SoftwareHeader no 669 670 ## StrictHeaders { yes | no } 671 ## default "no" 672 ## 673 ## Requests that the DKIM library refuse to process a message whose 674 ## header fields do not conform to the standards, in particular Section 3.6 675 ## of RFC5322. 676 677 # StrictHeaders no 678 679 ## StrictTestMode { yes | no } 680 ## default "no" 681 ## 682 ## Selects strict CRLF mode during testing (see the "-t" command line 683 ## flag in the opendkim(8) man page). Messages for which all header 684 ## fields and body lines are not CRLF-terminated are considered malformed 685 ## and will produce an error. 686 687 # StrictTestMode no 688 689 ## SubDomains { yes | no } 690 ## default "no" 691 ## 692 ## Sign for subdomains as well? 693 694 # SubDomains No 695 696 ## Syslog { yes | no } 697 ## default "yes" 698 ## 699 ## Log informational and error activity to syslog? 700 701 Syslog Yes 702 703 ## SyslogFacility facility 704 ## default "mail" 705 ## 706 ## Valid values are : 707 ## auth cron daemon kern lpr mail news security syslog user uucp 708 ## local0 local1 local2 local3 local4 local5 local6 local7 709 ## 710 ## syslog facility to be used 711 712 # SyslogFacility mail 713 714 ## SyslogSuccess { yes | no } 715 ## default "no" 716 ## 717 ## Log success activity to syslog? 718 719 # SyslogSuccess No 720 721 ## TemporaryDirectory path 722 ## default /tmp 723 ## 724 ## Specifies which directory will be used for creating temporary files 725 ## during message processing. 726 727 # TemporaryDirectory /tmp 728 729 ## TestPublicKeys filename 730 ## default (none) 731 ## 732 ## Names a file from which public keys should be read. Intended for use 733 ## only during automated testing. 734 735 # TestPublicKeys /tmp/testkeys 736 737 ## TrustAnchorFile filename 738 ## default (none) 739 ## 740 ## Specifies a file from which trust anchor data should be read when doing 741 ## DNS queries and applying the DNSSEC protocol. See the Unbound documentation 742 ## at http://unbound.net for the expected format of this file. 743 744 # TrustAnchorFile /var/named/trustanchor 745 746 ## UMask mask 747 ## default (none) 748 ## 749 ## Change the process umask for file creation to the specified value. 750 ## The system has its own default which will be used (usually 022). 751 ## See the umask(2) man page for more information. 752 753 # UMask 022 754 755 # UnboundConfigFile /var/named/unbound.conf 756 757 ## Userid userid 758 ## default (none) 759 ## 760 ## Change to user "userid" before starting normal operation? May include 761 ## a group ID as well, separated from the userid by a colon. 762 763 # UserID userid