Demo
Demo

Knowledge base

PMTA knowledge base›Configuration block§ 3.3.19

<domain-key-list>

A named list of signing keys
One client’s keys in their own list

The block collects domain-key lines under one name and is declared only at node level. By itself it signs nothing: the list is selected by the message — with the x-dkim-options header with the key-list= parameter, if the source is allowed process-x-dkim-options.

The search narrows to the list. For x-dkim-options: s=foo;key-list=xyz the engine looks for a key with the foo selector only in the xyz list and, if it does not find one, does not sign the message. Without key-list the usual selection applies — the sending address keys and those inherited from node level. The list narrows the key search for ARC signing the same way.

Why it is needed: on a node that signs mail for several clients, one client’s message will not get another client’s key, even if the selectors match.

Example configuration
<domain-key-list keylist-customer-one>
    domain-key m,mail.port25.com,/etc/pmta/m.pem    domain-key base,*,/etc/pmta/base.pem
</domain-key-list>
Following the manual’s example: a message with x-dkim-options: s=m;key-list=keylist-customer-one is signed with the m key, and one with a selector that is not in the list stays unsigned.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
Block directives: 1
Signing 1
domain-keyThe same signing key, but inside a named list
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
◇

What else to read

3 articles

◇Do not send what will fail the check at the receiverThe node checks the SPF of its own mail before sending: if it fails, it bounces the message without waiting for someone else’s refusal.◇How the node signs messages and chooses a keyThe key is chosen by the sending domain from the headers, going through the declarations from top to bottom.◇A message header with which the submitting side adjusts the signatureFive parameters in X-DKIM-Options: selector, domain, signing identity, query method and key list.

In the Hub
Cost of a mistake
reversible: harms only while it is set
Scenarios
Message signing and authentication