We recently moved from using Magic Winmail as our mail server to hMailServer since it was more cost effective (as in free) and had more features. One of these features is DKIM, or DomainKeys Identified Mail, which if enabled, would improve deliverability of our e-mails. Here’s how I set mine up:

1. Generate the public and private keys. You need OpenSSL to do this.

> openssl genrsa -out private.key 1024
> openssl rsa -in private.key -pubout -out public.key

2. Enter the corresponding TXT records into your DNS for your domain. For example, my domain is journal.suteki.nu. I would do the following in my DNS:

_domainkey.journal.suteki.nu  IN TXT  t=y; o=-;
_adsp._domainkey.journal.suteki.nu  IN TXT dkim=all
[selector]._domainkey.journal.suteki.nu  IN TXT  g=*; k=rsa; p=[public_key]

Where [selector] is the name of your selector (eg ‘mail’), and [public_key] is your key from your public.key file generated from #1. Just make up something for [selector] and keep note of it.

An example would be

_domainkey.journal.suteki.nu  IN TXT  t=y; o=-;
_adsp._domainkey.journal.suteki.nu  IN TXT dkim=all
mail._domainkey.journal.suteki.nu  IN TXT  g=*; k=rsa; p=bNJOPhYuAAxTdO0PNGiKSL9rLLdDBuj3q0Rpa3pg2r/oNTONqGSIb3DQ8mz16NbSSSs5YcBkKTRDunxOFP0UtEmZJMQk0yERL1jEg86l8ZDmOckldH5EWIhsnbDjGh1fxT5ku7cXjtKwIDAQABMIGfMA0GCSqADCBaku0mO6bbcm/mEfnBKov3otig6iPXiQKBgQDxdpMEBAQUAA4GNEdKCn

(
Note: That’s a made up public key
Notex2: The t=y is a testing flag. You will want to remove this once you’ve verified your keys work.
Notex3: It will take up to one day for your DNS records to propagate. Do not be frustrated if the tests come up negative within the first 10 minutes of filling in the records!
)

3. Set up DKIM in hMailServer for a domain.

Open up your hMailServer administrator and go to the domain you want to enable DKIM in. For the private key file, select the private.key you generated from #1. In selector, type in the [selector] you selected.

For signing algorithm, choose either SHA1 or SHA256. I went with SHA1 so our server resources do not get consumed as much when signing the e-mails. The config should look something like this:

Save the config. Your domain is now set up for DKIM.

4. Send a test e-mail from one of your accounts in the domain.

I sent a test-email from an account I created, test@journal.suteki.nu, to one of my accounts on gmail. When it arrived in gmail, I checked the headers:

What you want to check for is the dkim-signature block in the headers:

A successful one looks like this:

Authentication-Results: mx.google.com; dkim=pass header.i=@journal.suteki.nu
dkim-signature: v=1; a=rsa-sha1; d=journal.suteki.nu; s=mail;
	c=relaxed/relaxed; q=dns/txt; h=From:Subject:Date:Message-ID:To:MIME-Version:Content-Type:Content-Transfer-Encoding;
	bh=/edzoYuyn17WXm8KeqcX/R+khdQ=;	b=0cnc21MgZMy9suqAgFPlA5OqD5fpFmuGoK+UYlf9zvqPwRgRgjb6OP+VwjwYE2AVxhdVRdX8nEdQ0XnUht45SQHKh78dCXK+UiS7x6qE2haLrZi7CHvs6qp8otQdkcLBrYF0Z95Blp1Vh9BHvQFodNdwJUhgp9u/BoZH/Gq8xx0=

While an unsuccessful one might (might as in I haven’t determined if this is considered invalid, but this is what it first looked like for me) look like:

Authentication-Results: mx.google.com; dkim=neutral (no key) header.i=@journal.suteki.nu
dkim-signature: v=1; a=rsa-sha1; d=journal.suteki.nu; s=mail;
	c=relaxed/relaxed; q=dns/txt; h=From:Subject:Date:Message-ID:To:MIME-Version:Content-Type:Content-Transfer-Encoding;
	bh=/edzoYuyn17WXm8KeqcX/R+khdQ=;	b=h9BHvQFodNdw0cnc21MgZMy9suqAgFPlA5OqD5fpFmuGoK+UYlf9zvqPwRgRgjb6OP+VwjwYE2AVxhdVRdX8nEdQ0XnUht45SQHKh78dCXK+UiSp8otQdkcLBrYF0Z95Blp1V7x6qE2haLrZi7CHvs6qJUhgp9u/BoZH/Gq8xx0=

Hope that helps! See the links below for more information and a way to test and fine-tune your configuration.

Links:
Domainkeys for Postfix – Started with this guide
DKIM flags – understand what the flags are that we used above.
DKIM generator – Generates your private/public key and gives you the DNS info necessary to make DKIM work! You can skip Step #1 with this.
DKIM Tools – Verify your DNS DKIM records.
Author Domain Signing Practices (ADSP) – Understand what the _adsp record is for.