You will need to fix this as well, normaily virtualmin will update the maps when you save the file, have you been manually editing files?
Not 100% sure this can cause the issue, db maps can be updated with postmap command.
Backup you 2 files first before running this command just in case.
sudo postmap /etc/postfix/dependent
sudo postfix reload
Hello,
I tried disabling the dnssec check. That didn’t change anything.
I just updated the “dependent.db” file. I’ll let you know if that works.
Hello. It still doesn’t work after following the suggested steps.
You still need to look in the log. Every time you make a change, you look at the log to see what is now preventing delivery. Then you fix that problem and try again. And, look at the log again if it’s not fixed.
Earlier we were discussing GMail, but your example log was for Hotmail, which may have different behavior and requirements than GMail.
2026-06-24T13:14:46.422431+02:00 sd-102425 opendkim[1296]: A0B159A49C9: key retrieval failed (s=s1, d=gocardless.com): 's1._domainkey.gocardless.com' query timed out
Is gocardless.com your domain? I don’t know what I’m looking at.
Hello. No, gocardless.com is the domain that sent the email; it was successfully received in the tresorier@xxx.fr mailbox but was not forwarded to the @gmail.com and @hotmail.fr forwarding addresses.
The email arrives in the inbox fine, but it isn’t forwarded to the other email accounts.
This is the error message I found in the log.
Please wrap domain names and such in backticks (`), so your messages don’t get flagged by the spam filter. (Guidelines - Virtualmin Community)
I think we probably need to see more of that interaction. But, that specific error message would prevent delivery in some cases. But, since it’s not your domain, you can’t control the fact that it’s misconfigured. It’s plausible this specific message isn’t being delivered because of that misconfiguration.
So, I’d rather you show us a message that should be delivered (everything is valid) and isn’t…and all the log entries related to it. There will usually be several.
Here are the errors from the file “/var/log/mail.err”
2026-06-24T09:12:34.368254+02:00 sd-102425 opendkim[1296]: 10D199A04E9: key retrieval failed (s=sg, d=neetoholidays.com): 'sg._domainkey.neetoholidays.com' query timed out
2026-06-24T09:13:53.078824+02:00 sd-102425 opendkim[1296]: D8B2E9A04E9: key retrieval failed (s=s1, d=crdev.ai): 's1._domainkey.crdev.ai' query timed out
2026-06-24T11:18:12.377347+02:00 sd-102425 opendkim[1296]: 4BF469A2981: key retrieval failed (s=mailjet, d=visiteursdusoir.com): 'mailjet._domainkey.visiteursdusoir.com' query timed out
2026-06-24T11:26:08.113606+02:00 sd-102425 opendkim[1296]: 801129A089F: key retrieval failed (s=s1, d=authentification.pro.engie.fr): 's1._domainkey.authentification.pro.engie.fr' query timed out
2026-06-24T12:19:44.631802+02:00 sd-102425 opendkim[1296]: 2E78B9A2981: key retrieval failed (s=k3, d=mailchimpapp.net): 'k3._domainkey.mailchimpapp.net' query timed out
2026-06-24T12:29:16.445612+02:00 sd-102425 opendkim[1296]: 494D19A49D4: key retrieval failed (s=selector1, d=cityzmedia.fr): 'selector1._domainkey.cityzmedia.fr' query timed out
2026-06-24T13:12:52.229750+02:00 sd-102425 opendkim[1296]: C80749A49C9: key retrieval failed (s=s1, d=tomorrowslegendsllc.com): 's1._domainkey.tomorrowslegendsllc.com' query timed out
2026-06-24T13:14:46.422431+02:00 sd-102425 opendkim[1296]: A0B159A49C9: key retrieval failed (s=s1, d=gocardless.com): 's1._domainkey.gocardless.com' query timed out
2026-06-24T13:27:52.251213+02:00 sd-102425 opendkim[1296]: 2CD3D9A49D5: key retrieval failed (s=s2048, d=yahoo.de): 's2048._domainkey.yahoo.de' query timed out
2026-06-24T16:49:57.876302+02:00 sd-102425 opendkim[1296]: 3B3029A01F7: key retrieval failed (s=selector2-vediaudidf-onmicrosoft-com, d=vediaudidf.onmicrosoft.com): 'selector2-vediaudidf-onmicrosoft-com._domainkey.vediaudidf.onmicrosoft.com' query timed out
2026-06-24T17:53:36.026628+02:00 sd-102425 opendkim[1296]: EF0E49A01F7: key retrieval failed (s=busmail1, d=speed.at): 'busmail1._domainkey.speed.at' query timed out
2026-06-24T18:28:02.432818+02:00 sd-102425 opendkim[1296]: 0F3E29A05C8: key retrieval failed (s=paypal, d=news.paypal.com): 'paypal._domainkey.news.paypal.com' query timed out
2026-06-24T19:34:04.375267+02:00 sd-102425 opendkim[1296]: 2B9219A051F: key retrieval failed (s=s1, d=crdev.ai): 's1._domainkey.crdev.ai' query timed out
2026-06-25T00:04:53.615231+02:00 sd-102425 opendkim[1296]: 3FC689A4B9C: key retrieval failed (s=s1, d=crdev.ai): 's1._domainkey.crdev.ai' query timed out
2026-06-25T07:27:31.152201+02:00 sd-102425 opendkim[1296]: 1531D9A0A52: key retrieval failed (s=s20171208, d=naver.com): 's20171208._domainkey.naver.com' query timed out
Here is the email from GOCARDLESS.
Please also wrap logs in backticks (triple backticks in this case, ```), again so your message doesn’t get flagged by the spam filter.
All DKIM queries are timing out, including some that I think we’d expect to not be misconfigured. Which makes me think it actually is a problem you can solve, because it seems to be a problem on your system.
What name servers is your system using? Do they work?
I use a server from scaleway.com.
That doesn’t answer the question.
It probably uses systemd-resolved as the local caching nameserver, so see what it’s doing:
systemctl status systemd-resolved
And:
resolvectl status
systemctl status systemd-resolved :
● systemd-resolved.service - Network Name Resolution
Loaded: loaded (/usr/lib/systemd/system/systemd-resolved.service; enabled;>
Active: active (running) since Wed 2026-06-10 13:45:04 CEST; 2 weeks 1 day>
Docs: man:systemd-resolved.service(8)
man:org.freedesktop.resolve1(5)
https://www.freedesktop.org/wiki/Software/systemd/writing-network->
https://www.freedesktop.org/wiki/Software/systemd/writing-resolver>
Main PID: 741 (systemd-resolve)
Status: “Processing requests…”
Tasks: 1 (limit: 19048)
Memory: 8.3M (peak: 14.2M swap: 2.3M swap peak: 2.3M)
CPU: 14min 16.686s
CGroup: /system.slice/systemd-resolved.service
└─741 /usr/lib/systemd/systemd-resolved
Notice: journal has been rotated since unit was started, output may be incomple>
lines 1-16/16 (END)…skipping…
● systemd-resolved.service - Network Name Resolution
Loaded: loaded (/usr/lib/systemd/system/systemd-resolved.service; enabled; preset: enabled)
Active: active (running) since Wed 2026-06-10 13:45:04 CEST; 2 weeks 1 day ago
Docs: man:systemd-resolved.service(8)
man:org.freedesktop.resolve1(5)
https://www.freedesktop.org/wiki/Software/systemd/writing-network-configuration-managers
https://www.freedesktop.org/wiki/Software/systemd/writing-resolver-clients
Main PID: 741 (systemd-resolve)
Status: “Processing requests…”
Tasks: 1 (limit: 19048)
Memory: 8.3M (peak: 14.2M swap: 2.3M swap peak: 2.3M)
CPU: 14min 16.686s
CGroup: /system.slice/systemd-resolved.service
└─741 /usr/lib/systemd/systemd-resolved
resolvectl status :
Global
Protocols: -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
resolv.conf mode: stub
Link 2 (enp0s20f0)
Current Scopes: DNS
Protocols: +DefaultRoute -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 51.159.69.162
DNS Servers: 51.159.69.156 51.159.69.162
DNS Domain: online.net
Link 3 (enp0s20f1)
Current Scopes: none
Protocols: -DefaultRoute -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
root@sd-102425:~#
Do those name servers (51.159.69.156 51.159.69.162) work? Can you resolve those DKIM records?
e.g.
host -t txt busmail1._domainkey.speed.at
Try specifically querying each of those name servers, so if either is broken you can notify your host of the problem:
host -t txt busmail1._domainkey.speed.at 51.159.69.156
host -t txt busmail1._domainkey.speed.at 51.159.69.162
If either or both times out, you’d probably want to talk to your hosting provider (or switch to using working name servers like those provided by Google, 8.8.8.8 and 8.8.4.4, or Cloudflare, 1.1.1.1 and 1.0.0.1). If both work, then it’s something else…or a temporary problem at the time you were watching the logs, and you need to look at the log again now than DNS is working.
host -t txt busmail1._domainkey.speed.at
busmail1._domainkey.speed.at is an alias for busmail1._domainkey.a1business.at.
busmail1._domainkey.a1business.at descriptive text “v=DKIM1; k=rsa; p=MIICIjANBg kqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAs7Gmp4WuRZeUFvFKCDPJJLrV5AJgGyTXqlawHbeJLUEHo5 Cyefh1zBhuLvnYVicVJf+0bIkWFcU6Q5kTg0v+5fRYNrOZysIA1s05IfMEhebSW4Hv+qXW5oYjSP645p 01FyD2+dSIpcJ1dkJiW+X5GqspODN4NFHHWGZUf9G73hXnwhLKDbXL/AMkn4u3Tf+zq” “vwF0+FEKzi UDzsn1XMk7hEjnGyh/We3cDe+pgr4jbQVYmnQFWqPxjXhshNEdqRe8Z1UrBp3wC1skpc+gn66Q0qvaao kv16+NiVAUk26D+A5EttXdxJMxpE4oMkc+SsWbMB9lOcn/xIo5OBHNkoAzqQ2V/YuFu9ltp7LbBx8YYr 3ZdMxAdBsTQm7s0yIhZeXalqLcc5Chejh5YQa8gEw/wNLxqGj0WZLtADJBiA8WMNtnFktFR4jaiI6LzG rMBKU” “sn0bact/Y03XjMnYGWDJrUEg5I2AwPsRPGElGMkn5922ILI8DlVlwwwOMqlt7s9TLqutAhjv NNqaPOncn5EnEjet/zv3rDaQcY2NPvVWMcVuNV6pxCXnsYLVN89UevFteFJzq3HOLS4bb4XH+7Byd79W NeJwDpcZdy5lYW+wMeGnri8HSMN1J3YfUMrlFyqzMIDYHyPB81EJufab28YyHIMItDnjDLoCyitDC9re To0CAwEAAQ==”
host -t txt busmail1._domainkey.speed.at 51.159.69.156
Using domain server:
Name: 51.159.69.156
Address: 51.159.69.156#53
Aliases:
busmail1._domainkey.speed.at is an alias for busmail1._domainkey.a1business.at.
busmail1._domainkey.a1business.at descriptive text “v=DKIM1; k=rsa; p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAs7Gmp4WuRZeUFvFKCDPJJLrV5AJgGyTXqlawHbeJLUEHo5Cyefh1zBhuLvnYVicVJf+0bIkWFcU6Q5kTg0v+5fRYNrOZysIA1s05IfMEhebSW4Hv+qXW5oYjSP645p01FyD2+dSIpcJ1dkJiW+X5GqspODN4NFHHWGZUf9G73hXnwhLKDbXL/AMkn4u3Tf+zq” “vwF0+FEKziUDzsn1XMk7hEjnGyh/We3cDe+pgr4jbQVYmnQFWqPxjXhshNEdqRe8Z1UrBp3wC1skpc+gn66Q0qvaaokv16+NiVAUk26D+A5EttXdxJMxpE4oMkc+SsWbMB9lOcn/xIo5OBHNkoAzqQ2V/YuFu9ltp7LbBx8YYr3ZdMxAdBsTQm7s0yIhZeXalqLcc5Chejh5YQa8gEw/wNLxqGj0WZLtADJBiA8WMNtnFktFR4jaiI6LzGrMBKU” “sn0bact/Y03XjMnYGWDJrUEg5I2AwPsRPGElGMkn5922ILI8DlVlwwwOMqlt7s9TLqutAhjvNNqaPOncn5EnEjet/zv3rDaQcY2NPvVWMcVuNV6pxCXnsYLVN89UevFteFJzq3HOLS4bb4XH+7Byd79WNeJwDpcZdy5lYW+wMeGnri8HSMN1J3YfUMrlFyqzMIDYHyPB81EJufab28YyHIMItDnjDLoCyitDC9reTo0CAwEAAQ==”
host -t txt busmail1._domainkey.speed.at 51.159.69.162
Using domain server:
Name: 51.159.69.162
Address: 51.159.69.162#53
Aliases:
busmail1._domainkey.speed.at is an alias for busmail1._domainkey.a1business.at.
busmail1._domainkey.a1business.at descriptive text “v=DKIM1; k=rsa; p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAs7Gmp4WuRZeUFvFKCDPJJLrV5AJgGyTXqlawHbeJLUEHo5Cyefh1zBhuLvnYVicVJf+0bIkWFcU6Q5kTg0v+5fRYNrOZysIA1s05IfMEhebSW4Hv+qXW5oYjSP645p01FyD2+dSIpcJ1dkJiW+X5GqspODN4NFHHWGZUf9G73hXnwhLKDbXL/AMkn4u3Tf+zq” “vwF0+FEKziUDzsn1XMk7hEjnGyh/We3cDe+pgr4jbQVYmnQFWqPxjXhshNEdqRe8Z1UrBp3wC1skpc+gn66Q0qvaaokv16+NiVAUk26D+A5EttXdxJMxpE4oMkc+SsWbMB9lOcn/xIo5OBHNkoAzqQ2V/YuFu9ltp7LbBx8YYr3ZdMxAdBsTQm7s0yIhZeXalqLcc5Chejh5YQa8gEw/wNLxqGj0WZLtADJBiA8WMNtnFktFR4jaiI6LzGrMBKU” “sn0bact/Y03XjMnYGWDJrUEg5I2AwPsRPGElGMkn5922ILI8DlVlwwwOMqlt7s9TLqutAhjvNNqaPOncn5EnEjet/zv3rDaQcY2NPvVWMcVuNV6pxCXnsYLVN89UevFteFJzq3HOLS4bb4XH+7Byd79WNeJwDpcZdy5lYW+wMeGnri8HSMN1J3YfUMrlFyqzMIDYHyPB81EJufab28YyHIMItDnjDLoCyitDC9reTo0CAwEAAQ==”
So, it’s working fine currently. Are you still seeing DNS timeouts in the logs? You gotta keep looking at the logs.
Yes, still. And some emails do arrive in the inbox, but aren’t being forwarded to the Gmail, Outlook, etc., accounts.
So, we gotta figure out why DNS isn’t working for opendkim but not for anything else. I don’t know what to make of that. I’ve never seen it.
Have you tried simply restarting the opendkim service? Maybe it’s holding on to old DNS servers that don’t work anymore (that’d be really weird, and I don’t know why/how it would do that, since everything on your system is presumably using the local systemd-resolved and it seems to be able to resolve these names). I’m just not understanding how you’re seeing the behavior you’re seeing.
How do I restart opendkim?
