Again, thanks for the excellent tutorial.

You don’t necessarily have to setup something different per domain- you can sign all your outbound e-mail from the same domain/selector.

If you wanted to have a different config, based on the domain of the sender address, you could technically do a lookup based on the sender domain, and return values for each of the dkim_domain, dkim_selector and dkim_private_key values.

Then you could store these values in a lookup db, or SQL database by sender domain.

So as a quick (un-tested) example, you could do something like this:

remote_smtp:
driver = smtp
dkim_domain = $sender_address_domain
dkim_selector = x
dkim_private_key = ${lookup pgsql{select key from dkim where domain = ${quote_pgsql:$sender_address_domain}}{$value}}
dkim_canon = relaxed

Which would use a common selector of “x”, the domain of the sender e-mail, and a SSL key looked up from a PostgreSQL database by domain.

One thing to add is that one should perhaps also add an AuthorDomainSigningPolicy record:

_adsp._domainkey.yourdromain.something

as a text record containing “dkim=all” to indicate one signs all messages. Other option would be “dkim=unknown” to indicate only some mail is signed (for testing that is probably recommended).

Thanks for the pointing out that mistake Marcel.

As far as the live validation; port25.com has a similar auto-reply service; just send to check-auth@verifier.port25.com; their system also validates SPF, Sender-ID, and a few other things.

Cheers,

Mike