DKIM signature is not valid

Hello there !

I have a problem with DKIM … my mails come in to spamfolder in hotmail and gmail …

i tested my email here
mail-tester.com

my score ist 7/10 i got problem with the DKIM

Die DKIM Signatur Ihrer Nachricht ist:

v=1;
a=rsa-sha256;
c=simple/simple;
d=domain.com;
s=dkimpal;
t=1431174512;
bh=g3zLYH4xKxcPrHOD18z9YfpQcnk/GaJedfustWU5uGs=;
h=MIME-Version:Content-Type:Content-Transfer-Encoding:Date:From:To:Subject:Message-ID;
b=nPI9oWxQkV3JPBCJIkrNyY6OqRYu6WnAMujTnmuEHnO262/bfYbtUhvNPNGKG3RKc7LKRmciaKleuLQeGDFKAptcNXDbN7xOJp5BygMaqwOM0sW1wsfUYPPuQxTyFqx4+qdnDrIPDoCj4Qd1Ygkz0vpi0itOjazLjdF1oP8syjtvO9MMqYOEWb1WYshEs1vQy2h0kXyyUsZsYuCHxB062CL4G5kLrAvSHIVrRsqhxxB3IoFphR1axxTU3Sb7Vhtm98QZKlQrFcvj1VrcZ8w6RaRCiIU/JdCO1hrWkfr5fma5X6oq/PPgJvLEkO2Qw1bpVbzDC/xKr226JmPjegdQNg==

Ihr öffentlicher Schlüssel ist:

"v=DKIM1;
k=rsa;
t=s;
p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuZAimH4VzznW3lDiXTOqq0Rzb17RC1oO+fFCd9dldX4wR0jY7iFcOD5OSoN+kzYYibUckhcZJ/kP8W98KGegE2njGkDngVQjHLPCq3tacR+2iQ5RR/LMbAJn4J2+CpViOmq9cQWwC/zGH+SGcIQo872h0kDxm6kKJ0y4WM6JxZ433K2CKfxRMyG9off6"“e2VqeAt1AgE3Ky3Mc2jy1zR0Gb1s5aHL38uIg9jYOjIwHlY+BHWgqQBI65fdCx1iNwplbVyul5fCQUShcorB6AzDdBtjg2+JQX99niiBjKxBkkWLxl5mgaMnigvzJYslWWYW25p2QECn6EUBwHB5N6fYvwIDAQAB”
Schlüssellänge: 2048bits

Your DKIM signature is not valid

but i tested my dkim from here http://dkimcore.org/c/keycheck

and i got This is a valid DKIM key record

what is the problem ? i dont know how to fix it
could u please help me

many thanks

Did you wait for DNS to propagate (i think default is 12h)? When you know you will go to change/test your DNS is good to lower TTL to 300 (5 min) but for new TTL to kick in you must wait old one to expire, e.g. if old TTL was 12 hours then you must wait for that to expire and only then new time will start counting. Dont forget to set back to default once you are done.

i changed the dkim befor 3 weeks ! but i still having the same problem !

do u think i have a problem with the dns ?

Post your DNS here or if you dont know how to use forum codes then you can copy/paste to http://pastebin.com. Free to hide your domain and ip if you want. Another thing you can check and copy/paste is log files (maillog) and see what it say when you send email (just copy the part what was created by sending new email).

dkimpal._domainkey.domain.com 86400 TXT 0 v=DKIM1; k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuZAimH4VzznW3lDiXTOqq0Rzb17RC1oO+fFCd9dldX4wR0jY7iFcOD5OSoN+kzYYibUckhcZJ/kP8W98KGegE2njGkDngVQjHLPCq3tacR+2iQ5RR/LMbAJn4J2+CpViOmq9cQWwC/zGH+SGcIQo872h0kDxm6kKJ0y4WM6JxZ433K2CKfxRMyG9off6e2VqeAt1AgE3Ky3Mc2jy1zR0Gb1s5aHL38uIg9jYOjIwHlY+BHWgqQBI65fdCx1iNwplbVyul5fCQUShcorB6AzDdBtjg2+JQX99niiBjKxBkkWLxl5mgaMnigvzJYslWWYW25p2QECn6EUBwHB5N6fYvwIDAQAB

the maillog>

May 10 03:26:57 server postfix/pickup[1843]: 0099711A0B3F: uid=0 from=
May 10 03:26:57 server postfix/cleanup[17109]: 0099711A0B3F: message-id=<2015051 0012657.0099711A0B3F@server.domain.com>
May 10 03:26:57 server postfix/qmgr[1844]: 0099711A0B3F: from=<root@domain .com>, size=481, nrcpt=1 (queue active)
May 10 03:26:57 server postfix/smtp[17112]: cannot load Certificate Authority da ta: disabling TLS support
May 10 03:26:57 server postfix/smtp[17112]: warning: TLS library problem: 17112: error:0906D066:PEM routines:PEM_read_bio:bad end line:pem_lib.c:802:
May 10 03:26:57 server postfix/smtp[17112]: warning: TLS library problem: 17112: error:0B084009:x509 certificate routines:X509_load_cert_crl_file:PEM lib:by_file .c:285:
May 10 03:26:58 server postfix/smtp[17112]: 0099711A0B3F: to=a.kh@hotmail.de, relay=mx3.hotmail.com[207.46.8.199]:25, delay=1.5, delays=0.11/0.02/0.48/0.91, d sn=2.0.0, status=sent (250 <20150510012657.0099711A0B3F@server.domain.com > Queued mail for delivery)
May 10 03:26:58 server postfix/qmgr[1844]: 0099711A0B3F: removed

Based on your log i think your certificate is corrupted May 10 03:26:57 server postfix/smtp[17112]: warning: TLS library problem: 17112:error:0906D066:PEM routines:PEM_read_bio:bad end line:pem_lib.c:802:.
What you can do is to open that certificate and check if it looks like this:
-----BEGIN CERTIFICATE-----
/snipped code/
-----END CERTIFICATE-----

If you cant see anything wrong with your certificate then you could try to create new one.

I have bought 2 SSL one for www.domain.com and the other is for domain.com

i have the domain.com in the webmin installed and thats work perfect …
i go to Manage SSL Certificate
and then i click Copy to Postfix and Copy to Dovecot

but i have the same problem … i tried to delete them from the folder /etc/postfix and etc/Dovecot but i had the same error …

i dont know how to fix it

maillog after this

May 10 15:13:20 server postfix/smtp[4393]: cannot load Certificate Authority data: disabling TLS support
May 10 15:13:20 server postfix/smtp[4393]: warning: TLS library problem: 4393:error:0906D066:PEM routines:PEM_read_bio:bad end line:pem_lib.c:802:
May 10 15:13:20 server postfix/smtp[4393]: warning: TLS library problem: 4393:error:0B084009:x509 certificate routines:X509_load_cert_crl_file:PEM lib:by_file.c:285:

i have those certificates in the postfix folder

postfix.ca.pem
postfix.cert.pem
postfix.key.pem

the TLS setting in the main.cf of postfix

smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes broken_sasl_auth_clients = yes smtpd_sasl_security_options = noanonymous smtpd_sasl_local_domain = $myhostname smtpd_sasl_authenticated_header = yes

Replace this with your SSL certificate path if you are using one.

smtpd_tls_cert_file = /etc/postfix/postfix.cert.pem
smtpd_tls_key_file = /etc/postfix/postfix.key.pem
smtpd_tls_CAfile = /etc/postfix/postfix.ca.pem
smtpd_use_tls=yes
smtp_tls_security_level = may
smtpd_tls_security_level = may
#smtpd_tls_auth_only = no
smtp_tls_note_starttls_offer = yes
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
smtpd_delay_reject = yes
disable_vrfy_command = yes
smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt
milter_default_action = accept
milter_protocol = 2
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891
smtpd_tls_mandatory_ciphers = high

is this correct ? can those setting cause this issue

Check if you have one empty line after “-----END CERTIFICATE-----”. It should be like this:
1.-----BEGIN CERTIFICATE-----
2.
3. /snipped code/
4. … 20+ lines (its really not important how many if your cert is valid)

25. -----END CERTIFICATE-----
26.

i checked the postfix.cert.pem it is ok no empty line
but in the virtualmin panel i checked the DomainKey Options and i saw an empty line i removed it
but still the same problem

i deleted all the lines for the tls in the main.cf i dont get any error now in the maillog but still the dkin is not valied :frowning:

is the tls important for the dkim ?

You sure you dont have any errors now? Its strange because that is usually result of lacking that empty line.
Can you make a test and put back that empty line in all cert and see if the problem comes back, even in the cert who originally didnt have it.

yes im sure i dont have any errors now … i made the test and putet back the empty line … i dont see any problem now … i think the problem is with this lines in the main.cf

cause these lines i copied them from internet and i dont know if they are good ?

for SMTP-Auth setting

smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_authenticated_header = yes

Replace this with your SSL certificate path if you are using one.

smtpd_tls_cert_file = /etc/postfix/postfix.cert.pem
smtpd_tls_key_file = /etc/postfix/postfix.key.pem
smtpd_tls_CAfile = /etc/postfix/postfix.ca.pem
smtpd_use_tls = yes
smtpd_tls_auth_only = yes
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
smtpd_tls_loglevel = 3
tls_random_source = dev:/dev/urandom

Uncomment the next line to generate “delayed mail” warnings

#delay_warning_time = 4h

will it be a permanent error or temporary

unknown_local_recipient_reject_code = 450

how long to keep message on queue before return as failed.

some have 3 days, I have 16 days as I am backup server for some people

whom go on holiday with their server switched off.

maximal_queue_lifetime = 7d

max and min time in seconds between retries if connection failed

minimal_backoff_time = 1000s
maximal_backoff_time = 8000s

how long to wait when servers connect before receiving rest of data

smtp_helo_timeout = 60s

how many address can be used in one message.

effective stopper to mass spammers, accidental copy in whole address list

but may restrict intentional mail shots.

smtpd_recipient_limit = 16

how many error before back off.

smtpd_soft_error_limit = 3

how many max errors before blocking it.

smtpd_hard_error_limit = 12

This next set are important for determining who can send mail and relay mail

to other servers. It is very important to get this right - accidentally produ$

an open relay that allows unauthenticated sending of mail is a Very Bad Thing.

You are encouraged to read up on what exactly each of these options accomplis$

Requirements for the HELO statement

smtpd_helo_restrictions = permit_mynetworks, warn_if_reject reject_non_fqdn_hos$

Requirements for the sender details

smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, warn_$

Requirements for the connecting server

smtpd_client_restrictions = reject_rbl_client sbl.spamhaus.org, reject_rbl_clie$

Requirement for the recipient address. Note that the entry for

“check_policy_service inet:127.0.0.1:10023” enables Postgrey.

smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, re$
smtpd_data_restrictions = reject_unauth_pipelining

require proper helo at connections

smtpd_helo_required = yes

waste spammers time before rejecting them

smtpd_delay_reject = yes
disable_vrfy_command = yes
milter_default_action = accept
milter_protocol = 2
smtpd_milters = inet:localhost:8891
non_smtpd_milters = inet:localhost:8891

smtpd_tls_mandatory_ciphers = high

otherway i cant recive emails from outside the server … when i send a test email to me … i recived it but when i send a test email to me from hotmail i dont recive anything and after oneday i get a delay email from hotmail
Delivery Status Notification (Delay)‏

what can i do know for the dkim sorry but realy i dont have any idea to solve this problem i hop u can help me with that

thanks alot

So you can receive emails from other servers/services but you have problem to send your emails, or its the other way around you can send but you cant receive?

i can send emails to anthor servers but i cant receive email

Logs what you linked me yesterday was about corrupted certificates (SSL) what we sort (hope you left that empty line at the end of every certificate). DKIM problem would be when you send email and then that email get marked as spam or deleted because of invalid DKIM.

Now back to your second problem. If you can send but cant receive emails that could be because your firewall or you are missing MX records in your DNS. You can check DNS first as usually there is the problem.
If you dont use external email service like GoogleApps but local mail server then you should have this in your DNS:
mail.yourdomain.com. IN A xxx.xxx.xxx.xxx
yourdomain.com. IN MX 5 mail.yourdomain.com.

Yes i have those dns record

Interesting. You should take a look at your firewall if you have open port 25 and in case you are behind a router take a look there. Another reason it could be you are hosting from home and in that case its probably your ISP who is blocking some ports, for sure port 25.

i checkd in my vps firewall port 25 is opend and i dont know what if my isp ist blocking the port 25 can cause this problem …

iam afriad that the problem is caused from the setting of postfix and dovecot …

how can we test it … no error messege are in the maillog

Try to connect with telnet to port 25 of your server and see if you can. If the result is positive then the problem could be hiding in master.cf or main.cf. In that case maybe Eric could help as right now i cant see anything wrong with your main.cf (at least part what you posted here).
You can try with “intodns.com” and “mxtoolbox.com/SuperTool.aspx” to see if you can spot any problems.