Knowledge base
dkim-sign<domain>criticalset by the HubDirectiveTurns signing on for the receiver; the key itself is chosen by the sending domain from the message headers.domain-keyGlobalcriticalDirectiveLinks a selector, a domain and a private key; the first entry whose domain matches or is a parent domain wins.check-spf-inbound<source>DirectiveEnables the check on the way in and adds a header with its result to the message.check-spf-outbound<domain>DirectiveIf it fails, the message is bounced on our side before it reaches the receiving server; a temporary error means a retry.dkim-identity<domain>DirectiveLets you sign with your own key messages whose From has someone else’s domain — sending on behalf of a client.name-serverGlobalDirectiveSets name server addresses; the line is repeated, and the engine goes through them in rotation. If not set, the operating system’s resolvers are used.precached-domains-file<dns>DirectiveA text file with one domain per line; the listed domains are resolved regardless of whether there are messages for them in the queue.precached-refresh-interval<dns>DirectiveSets a refresh schedule instead of the receiver’s record time to live: these domains’ own TTL is ignored.reject-spf-check-fail<source>DirectiveThe most unambiguous of the three outcomes: the domain owner said that mail must not be sent from this address.reject-spf-check-permerror<source>DirectiveThe sender forbade nothing — it made a syntax mistake; the default rejects anyway.reject-spf-check-temperror<source>DirectiveThe only one of the three outcomes where the refusal is temporary: the sender is invited to retry.arc-identity<domain>DirectiveUnlike the regular signature, the name goes into the domain field — the very one the recipient uses to look up the key.arc-sign<domain>DirectiveEnables three ARC headers; the keys are the same as for the regular signature.check-arc-inbound<source>DirectiveThe same observational check as for the regular signature; it has no refusals either.check-dkim-inbound<source>DirectiveObservation only: the engine has no refusals based on the signature check result at all.check-iprev-inbound<source>DirectiveA reverse address check: the PTR record is compared with the name the submitter introduced itself with.check-spf-inbound-max-void-lookups<source>DirectiveThe threshold protects the resolver from being spun up by someone else’s record — and turns complex records into a permanent error.dkim-add-body-limit<domain>DirectivePuts the length of the signed part into the signature: an appended footer no longer breaks it — and is no longer noticeable.dkim-disallow-adding-headers<domain>DirectiveThe reverse task: the listed names are put into the signature one extra time, and the appearance of such a header breaks it.dkim-headers<domain>DirectiveThe mandatory list cannot be changed — this line only adds your own to it.dkim-identity-fallback<domain>DirectiveNo key matched the sender’s domain — we sign with our own instead of sending without a signature.domain-key<domain-key-list>DirectiveThe list narrows the key search to itself — and is chosen by a message header, not by the configuration.edns-udp-lengthGlobalDirectiveEnables the EDNS extension and sets the maximum UDP response size; without it responses longer than 512 bytes are truncated, and the route may be assembled incompletely.precached-max-domains<dns>DirectiveA ceiling on the number of domains taken from the file; it cannot exceed the number of lines in the file, and extra lines are cut off silently.process-x-dkim-options<source>DirectiveA permission for the source: with it the header sets the selector, domain, identity and query method for signing one message; without it the header is ignored and stays in the message.reject-iprev-check-fail<source>DirectiveThe default is to let it through, the opposite of the same-named line in the SPF family.reject-iprev-check-permerror<source>DirectiveA permanent reverse check error is almost always someone else’s unfilled zone, not a forgery.reject-iprev-check-temperror<source>DirectiveA temporary name resolution failure; the rejection here is temporary too, and usually your own resolver is to blame.arc-algorithm<domain>DirectiveThere is exactly one value; the line exists for completeness of the set, not for choice.arc-body-canon<domain>DirectiveThe only ARC canonicalization line where there really is a choice.arc-expire-after<domain>DirectiveThe default is never; a forwarder’s window for reuse is especially large.arc-headers<domain>DirectiveThe mandatory set is the same as for the ordinary signature; the line only adds to it.arc-headers-canon<domain>DirectiveExactly one method is supported; unlike the ordinary signature, there is no choice.arc-identity-fallback<domain>DirectiveFor a forwarder this is not a fallback but the main path: it never has other people’s keys.arc-oversigned-headers<domain>DirectiveThe same protection against substitution as with the ordinary signature; there is no default, and without the line it does not act.check-spf-inbound-best-guess<source>deprecatedDirectiveThe manual marks it as deprecated and explicitly advises against using it.dkim-add-timestamp<domain>DirectiveOne field by which you can later tell when the message was signed.dkim-algorithm<domain>DirectiveThe default is right; the second value is obsolete and no longer accepted by receivers.dkim-body-canon<domain>Directiverelaxed forgives extra spaces in lines, simple does not; empty lines at the end of the body do not count under either.dkim-expire-after<domain>DirectiveThe default is never; an expiry is set where reuse of a signed message is feared.dkim-headers-canon<domain>Directiverelaxed forgives spaces and the case of names, simple forgives nothing.dkim-query-method<domain>DirectiveThere is exactly one lookup method, and it is implied by default; the line exists for compatibility.How the node signs messages and chooses a keycriticalMechanismThe key is chosen by the sending domain from the headers, going through the declarations from top to bottom.Do not send what will fail the check at the receivercriticalMechanismThe node checks the SPF of its own mail before sending: if it fails, it bounces the message without waiting for someone else’s refusal.The node needs a resolver that does all the work itselfMechanismThe engine requires recursive name resolution; a resolver that answers with a referral to another server forces the query to be repeated and triggers a log warning.A second signature on the same messageMechanismTwelve lines with the second- prefix: the message is signed twice, with different keys and under different identities.Keeping selected domains resolved at all timesMechanismA file with a list of domains whose DNS records are refreshed on their own schedule, independently of the queue and regardless of their own time to live.A signing key that came along with the messageMechanismA private key is passed in a message header; the node signs with it and removes the header before sending.A message header with which the submitting side adjusts the signatureMechanismFive parameters in X-DKIM-Options: selector, domain, signing identity, query method and key list.A signature that preserves someone else's verification when forwardingMechanismThree headers in which the forwarder attests: the message came to me like this and with these verification results.Authentication directive indexMechanismA summary of the directives related to login: they are scattered across several blocks.How to enable DKIM signing from scratchcriticalProcedureEight steps: domain, selector, key, permissions, DNS record, declaration, enabling and routing.Change a signing key without interrupting sendingProcedureAdd the new key under a new selector, apply, start signing with it, wait for messages with the old one to leave — and only then remove the old one.<dns>Configuration blockThe DNS precache block: a file with a list of domains, a ceiling on their number and a refresh schedule. Resolvers are set outside the block.<domain-key-list>Configuration blockA named list of domain-key lines at node level: a message selects it with the x-dkim-options header with key-list=, and the key is searched only in that list.check spfCommandReturns the same verdict as the recipient — based on the address, the greeting name and the return address.clear dnscacheCommandRemoves all records of a domain from the engine’s DNS cache; with a star, the whole cache.resolveCommandQueries a domain’s MX records and addresses and with –connect connects to the first available mail host.show precacheCommandPrints the domains whose records the node refreshes regardless of the queue contents.check mfromdeprecatedCommandChecked the return address by the Sender-ID standard; became obsolete along with it — the manual refers to the SPF check.The name lookup did not complete — and no conclusion is drawnError codeThe name service query failed, usually on timeout; the engine deliberately does not bounce the message on such a failure.Name cacheMetricThe number of names in the cache and the number of queries waiting for a response; separately, active queries.