Demo
Demo

Knowledge base

PMTA knowledge base›Block <source>›Directive§ 3.3.7.20

trace-dkim-check

<source>

Whether to put signature verification queries into the message header
in the configuration this is a linetrace-dkim-check falseinside the block <source>
A trace of signature verification

Adds to the header with verification results all DNS queries made while verifying the signature — that is, the public key lookup. The default is not to add them.

The benefit is one: when signature verification gives an unexpected result, the trace shows exactly which key the node looked for and what it got in response. Without the trace you have to repeat the query by hand and hope DNS answers the same way.

The trace travels with the message — as with the other lines of this kind.

The main trap is the same as for the neighbors: turned on temporarily, it stays forever. The only difference is that messages with several signatures have a longer trace — queries are made for each.
What the Hub does. It does not write it: signature verification on input is not enabled. Like the other traces, this line belongs only in a temporary edit.
Recommended values

Only for the duration of an investigation. And with a comment.

Narrow the source. The trace will get only into messages from the specified network.

A manual query is often enough. The public key is looked up with one command by the selector and domain from the signature.

The advice to use a manual query is ours. From the manual come the default and the composition of the trace: all DNS queries.
Example configuration
# TEMPORARY: investigating why signature verification fails
<source 198.51.100.0/24>
    check-dkim-inbound true
    trace-dkim-check true</source>
The selector and domain for a manual check are taken from the message’s signature itself — they are visible without the trace.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends1 mistake▶

Leaving it on after the investigation

our experience

What it costsEvery accepted message carries public key queries outward. Messages with several signatures have an even longer trace.
How to spot itDNS queries are visible in the headers of accepted messages.
How to do it rightTurn it off; enable it with a comment and temporarily.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
trace-dkim-check <boolean>
Values
yes or no; true and false are accepted on a par with them
Default
false § 3.3.7.20
Applying
reload, no restart needed
Queue
will not touch what is already queued
Where to write it
<source>
How many times
once in the block
Everything here comes from the manual, with the section.
Inheritance
The value is set in a <source> block and applies to mail submitted by a matching source; with several matching blocks, the most exact wins. It triggers only with check-dkim-inbound enabled. It is picked up by pmta reload.
⇄

Related directives

1 relation

Does not work without

check-dkim-inbound<source>The line does not trigger until signature verification is enabled. § 3.3.7.20

How to check on the node
The value is set in the source configuration; the same key can be queried by hand:
grep -n trace-dkim-check /etc/pmta/config
dig +short TXT k1._domainkey.example.org
The selector and domain for the second command are taken from the signature fields in the message itself. The Hub does not write this line.
◇

What else to read

3 articles

◇Who is allowed to submit mail and for whom to accept itOut of the box, the node accepts submission only from the machine itself; two different questions — “who can send through us” and “for whose addresses we accept mail” — are answered by different directives.◇Two inbound report processors and what to do with themBounces by message and complaints are parsed by two identically structured blocks; each has its own address list and its own pair of decisions about the message’s fate.◇Address lists — named and unnamedA list of addresses, domains, patterns or hashes; a named one is attached by directives such as suppression, an unnamed one lives inside an inbound mail processor.

In the Hub
Cost of a mistake
safe: a wrong value breaks nothing
Scenarios
Receiving inbound mail
Neighboring settings of the block <source>:log-commandslog-tlslog-connectionstrace-iprev-checklog-dataAll 74 directives of the block →