Configuring mail SMTP server exim and HestiaCP to use SPF and DKIM

Hosting notification.vip on Clouding.io VM

Before to begin with the steps to configure DKIM, i must note that i will put as example my recent installation of DKIM for my new domain name notification.vip hosted in a VM on clouding.io datacenter. This publication is not promoted by them at all. But i only can recommend its excellent services adn the incredible performance of their infraestructure for cloud computing.

Enable SMTP ports on CLOUDING.IO

Check that the VM on the clouding.io panel (Network tab) has enabled the SMTP sending. If not, you must require it to Clouding.io support team.

DNS settings

On clouding.io Dashboard panel go to DNS tab:

https://portal.clouding.io/dsb/dns/zones

and add a new domain (zone): notification.vip and once added edit this zone to add DNS records like:

PTR record

Also on DNS area of the Clouding.io Dashboard panel , go to PTR records:

And add this record:

Let's Encrypt

On HestiaCP panel:

Go to WEB section and Edit the domain you created (recommendable to create domains not-under root user, but under a new user, although this will be the unique domain in this machine). Once there, choose to enable Let's Encrypt certificate.

Install & configure DKIM

1. Go to HestiaCP > Mail > notification.vip click on Edit icon and:

• enable "DKIM"
• enable "SSL for this domain"
• enable "Use Lets Encrypt to obtain SSL certificate"

Note: with this action hestiaCP will add new DNS records to the zone of this domain. Maybe you will need to move those records to the clouding.io DNS management area for this domain (outside of the VM), if you don't have delegated the DNS zone to HestiaCP. By default it is not.

2. Generate a SSL pair-key for DKIM, from terminal connected to VM:

Note 1: you can create a key-pair like this **for each domain name hosted on your VM**.

Note 2: you will not find the last 2 commands (chown/chmod) in the usual guides for DKIM, but i think that it's needed in some cases, because if not, the keys are only available to root user by default.

3. Add a new DNS record to the ZONE (i did it twice: hestia/clouding.io) with:

Note 1: the content of p= is the PUBLIC_KEY generated on
/etc/exim4/dkim/notification.vip.pub

Note 2: don't put the double quotes for value on the clouding.io panel, but do it when adding the record in HestiaCP.

4. Edit exim config template file:

Search for "DKIM" and set something like this, specially taking care in the path where the DKIM_FILE of the secret key is:

Note: although it's optional it didn't run for me until i added the line with DKIM_SIGN_HEADERS

5. Then update exim4 conf and restart service:

6. After wait for propagation of new DNS record, test it at:

• https://www.mail-tester.com
• https://www.dmarcanalyzer.com/dkim/dkim-check/

Note 1: you can also sent an email to Gmail and look for the "source" of the email, and there GMAIL comment it the email 'PASS' SPF and DKIM signatures.

Note 2: for your tests don't send emails from your new mailbox to the SAME mailbox!!! I learned it after WASTE almost 2 days of my life, hahaha. Because -briefly- exim use a different "sending mechanism" (different 'routers' and 'trasport' profiles/drivers) when sending mails WITHIN THE SAME DOMAIN NAME (local_delivery vs. remote_smtp transport). Specifically: the mails are not DKIM signed!! So you want to check if exim is adding the DKIM signature to the sent emails try to send to another domain name!

7. After verify DKIM and SPF is running well, add this other DNS record, for announce DMARC:

Useful terminal commands to debug & monitor

1. To fastly send an email:

2. To show the config lines used by exim regarding DKIM:

3. To get the current DKIM DNS propagated record:

You must get something like this:

And be sure that this match exactly with the key inside notification.vip.pub

4. To see the exim log:

5. To see the daily stats of exim:

External checking tools

• https://dnschecker.org (DNS propagation)
• https://intodns.com (DNS configuration)
• https://www.sslshopper.com/ssl-checker.html (check SSL)
• https://mxtoolbox.com/SuperTool.aspx (check mail SPF)
• https://www.mail-tester.com (test email deliveraty ratio, spamAssasin test)
• https://appmaildev.com/en/dkim (test DKIM, SPIF, DMARC...)
• https://dkimcore.org/tools/keycheck.html (Official DKIM checker)

USEFUL publications about DKIM & HestiaCP

• CLOUDING.IO: Primeros pasos con HestiaCP (spanish)
• CLOUDING.IO:  Cómo configurar el correo en HestiaCP (spanish)
• Official DKIM specification (english)