hmLoadTopic({
hmKeywords:"Cryptographic,Cryptographic Signing,DK & DKIM signing,DKIM,DKIM DNS,DKIM Private Keys,DKIM Public Keys,DKIM Selectors,DKIM Signing,DomainKeys Identified Mail,Signing",
hmTitle:"DKIM Signing",
hmDescription:"Use the options contained on the DKIM Signing screen to configure MDaemon to sign eligible outbound messages using DKIM, and to define the criteria that will make a message...",
hmPrevLink:"security--dkim_verify.html",
hmNextLink:"security--dkim_options.html",
hmParentLink:"security--domainkeys_identified_mail.html",
hmBreadCrumbs:"<a href=\"security_menu.html\">Security Menu<\/a> &gt; Security Manager &gt; Sender Authentication &gt; <a href=\"security--domainkeys_identified_mail.html\">DomainKeys Identified Mail<\/a>",
hmTitlePath:"Security Menu > Security Manager > Sender Authentication > DomainKeys Identified Mail > DKIM Signing",
hmHeader:"<h1 class=\"p_Heading1\" style=\"page-break-after: avoid;\"><span class=\"f_Heading1\">DKIM Signing<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_BodyText_Center\"><img style=\"margin:0 auto 0 auto;width:32.5625rem;height:26.9375rem;border:none\" src=\".\/images\/sender-authentication_dkim-signing.png\"\/><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_Comment\">Use<\/span><span class=\"f_BodyText\"> the options contained on the DKIM Signing screen to configure MDaemon to sign eligible outbound messages using DKIM, and to define the criteria that will make a message eligible. You can also use this screen to designate selectors and generate corresponding public and private keys suitable for use with the DKIM specification. A default selector (&quot;MDaemon&quot;) and a default public and private key are created for you automatically on startup. All keys are unique—they are never the same from one site to another, regardless of the selector specified. By default, keys are generated with a secure bit depth of 2048 bits.<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">DKIM Signing<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Sign eligible outbound messages using DKIM<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this option if you wish to use DomainKeys Identified Mail to cryptographically sign some outgoing messages. In order for a message to be signed, it must meet the criteria designated under the <\/span><span style=\"font-family: Arial,Helvetica,sans-serif; font-style: italic; color: #010100;\">Define which messages are eligible for signing<\/span><span class=\"f_ControlIndent\"> button and be received by MDaemon for delivery on an authenticated session. There is also a Content Filter action, &quot;<\/span><span style=\"font-family: Arial,Helvetica,sans-serif; font-style: italic; color: #010100;\">Sign with DKIM selector...<\/span><span class=\"f_ControlIndent\">&quot; that you can use to cause messages to be signed.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">...sign mailing list messages<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">Click this check box if you wish to cryptographically sign all outgoing Mailing List messages. Because MDaemon will sign all mail to all of your lists, you do not need to use the &quot;<\/span><span style=\"font-family: Arial,Helvetica,sans-serif; font-style: italic; color: #010100;\">Define which messages are eligible for signing<\/span><span class=\"f_ControlIndent2\">&quot; option to authorize them for cryptographic signing.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Default selector<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">From the drop-down list, choose the selector whose corresponding public\/private key pair you wish to use when signing messages. If you wish to create a new key pair with a different selector, type the desired selector name here and click &quot;<\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Create new public and private keys<\/span><span class=\"f_ControlIndent\">&quot; below. If you wish to sign some messages using an alternate selector, designate a specific selector under the &quot;<\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Define which messages are eligible for signing<\/span><span class=\"f_ControlIndent\">&quot; option, or create a Content Filter rule using the &quot;<\/span><span style=\"font-family: Arial,Helvetica,sans-serif; font-style: italic; color: #010100;\">Sign with DKIM selector...<\/span><span class=\"f_ControlIndent\">&quot; action.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Delete this selector<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this button if you wish to delete a selector. Follow the on-screen instructions that appear.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Create new public and private keys<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this button to generate a public\/private key pair for the selector specified above. A public\/private key pair will be generated for the selector, and the file <\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">dns_readme.txt<\/span><span class=\"f_ControlIndent\"> will be generated and automatically opened. This file contains example DKIM data that you will need to publish to your domain<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif; color: #010100;\">\'<\/span><span class=\"f_ControlIndent\">s DNS records listing your DKIM Policy and the public key for the designated selector. The file lists samples for both testing and not testing status, and for whether you are signing all messages or just some messages originating from your domain. If you are currently testing DKIM or this selector, then you will need to use the information contained in the Testing entries for either the Policy or the selector, depending on what you are testing. Otherwise you will need to use the Not Testing entries.<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">All keys are stored in <\/span><span style=\"font-size: 1.10rem; font-family: \'Courier New\',Courier,monospace; color: #010100;\">PEM<\/span><span class=\"f_ControlIndent\"> format, and all selectors and keys are stored under the <\/span><span style=\"font-size: 1.10rem; font-family: \'Courier New\',Courier,monospace; color: #010100;\">\\MDaemon\\Pem<\/span><span class=\"f_ControlIndent\"> folder in the following way:<\/span><\/p>\n\r<p class=\"p_Code2\"><span class=\"f_Code2\">\\MDaemon\\Pem\\&lt;Selector&gt;\\rsa.public - public key for this selector<\/span><\/p>\n\r<p class=\"p_Code2_LastItem\"><span class=\"f_Code2_LastItem\">\\MDaemon\\Pem\\&lt;Selector&gt;\\rsa.private - private key for this selector<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/forbidden_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">The files contained in these folders are not encrypted or hidden, but they contain RSA private encryption keys that should never be accessed by anyone without permission. You should therefore take steps to secure these folders and subfolders using your OS tools.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Define which messages are eligible for signing<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">If you have elected to sign eligible outbound messages, click this button to edit the<\/span><span style=\"font-size: 1.10rem; font-family: \'Courier New\',Courier,monospace; color: #010100;\"> DKSign.dat<\/span><span class=\"f_ControlIndent\"> file, which contains the list of domains and addresses that MDaemon will use to determine whether or not a message should be signed. For each address listed you must designate whether or not the message should be <\/span><span style=\"font-size: 1.10rem; font-family: \'Courier New\',Courier,monospace; color: #010100;\">To<\/span><span class=\"f_ControlIndent\"> or <\/span><span style=\"font-size: 1.10rem; font-family: \'Courier New\',Courier,monospace; color: #010100;\">From<\/span><span class=\"f_ControlIndent\"> that address in order for it to qualify to be signed, or you can designate some other header such as &quot;<\/span><span style=\"font-size: 1.10rem; font-family: \'Courier New\',Courier,monospace; color: #010100;\">Reply-To<\/span><span class=\"f_ControlIndent\">&quot; or &quot;<\/span><span style=\"font-size: 1.10rem; font-family: \'Courier New\',Courier,monospace; color: #010100;\">Sender<\/span><span class=\"f_ControlIndent\">&quot;. Optionally, you can designate a selector for each entry, which will be used when signing a message that matches that entry. Finally, you can specify an optional signing domain to be used in the &quot;d=&quot; tag within the signature header. This can be useful, for example, when you have multiple sub-domains signing messages. In such cases you could use the &quot;d=&quot; tag to tell the receiving servers to look for the DKIM keys in a single domain<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif; color: #010100;\">\'<\/span><span class=\"f_ControlIndent\">s DNS record, thus making it possible for you to manage all of the keys in one record rather than having to manage separate records for each sub-domain. Wildcards are permitted in domains and addresses.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">All messages from local domains are eligible for signing<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Use this option if you wish to make all messages from your local domains eligible for signing. If you use this option then you do not need to add any of your local domains to the eligibility list (i.e. the <\/span><span class=\"f_T_Code\">DKSign.dat<\/span><span class=\"f_ControlIndent\"> file) unless you wish to designate a specific selector or &quot;<\/span><span class=\"f_T_Code\">d=<\/span><span class=\"f_ControlIndent\">&quot; tag to be used when signing a specific domain’s messages. This option is enabled by default.<\/span><\/p>\n\r<p class=\"p_SeeAlso\" style=\"page-break-after: avoid; border-right: none; border-bottom: none; border-left: none;\"><span class=\"f_SeeAlso\">See:<\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"security--domainkeys_identified_mail.html\" class=\"topiclink\">DomainKeys Identified Mail<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"security--dkim_options.html\" class=\"topiclink\">DKIM Settings<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"security--dkim_verify.html\" class=\"topiclink\">DKIM Verification<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\">&nbsp;<\/span><\/p>\n\r"
})
