Knowledge Base

This article describes how to download the Windows version of OpenSSL. Using the output of OpenSSL, you are then led through configuring DKIM in your Sophos and what records need to be added to your public authoritative name server.

Applies to the following Sophos product(s) and version(s)
Sophos UTM
Sophos UTM v9
Sophos UTM v7
Sophos UTM v8

Operating systems
UTM Linux

What To Do

Using DKIM with the Sophos is easy to establish. It is also difficult to cause a problem with your email.

At first let’s take an example where you send an email to a friend who has installed DKIM testing (if he doesn’t have it, it has no effect). If his server didn’t find a DKIM-Signature in your email, it would simply pass it along to the next screening process. If the DKIM TXT records in your DNS have an error (other than a wrong public key), your email is treated as if it had no DKIM-signature.

It does see a DKIM-Signature in your email though, so it queries the authoritative name server for your domain and captures your public key. His DKIM process then compares it to your email and the calculated key it contains.That confirms the email originated in your domain and has not been modified since your email then is passed along to the next step with a “dkim-pass” message.

If the public key doesn’t fit with the calculated key and the email, the result would be a “dkim-fail” indication. If someone else were to try to spoof an email from you, then your friend’s server likely would reject the email. 

Configuring DKIM (DomainKeys Identified Mail) in the Sophos SMTP Proxy Using the Windows OpenSSL Tool

Here’s how to get started. The examples and instructions are for Windows, Windows Server and Exchange 2003:

If necessary, obtain the Windows version of OpenSSL:

a. Download the latest version from: http://www.slproweb.com/products/Win32OpenSSL.html
b. The batch file below assumes that you will install into C:\Program Files\OpenSSL and that you will NOT have the dlls placed into the Windows directory.

Create keymaker.bat from the following and save it in C:\Windows\

IF EXIST rsa.private.%1 GOTO exists
C:\Progra~1\OpenSSL\bin\openssl genrsa -out rsa.private.%1 1024
C:\Progra~1\OpenSSL\bin\openssl rsa -in rsa.private.%1 -out
rsa.public.%1 -pubout -outform PEM
ECHO off echo Files created for %1
GOTO done
:exists
ECHO off ECHO Files for %1 not created because they already exist.
ECHO Please, erase them or try a different name.
ECHO .
:done

Press Windows Start and Run the keymaker batch file

keymaker yourdomain (replace yourdomain with the appropriate domain name)

Copy to a safe place the files just created

Copy the rsa.*.yourdomain files to a safe place. Right-click on each file, choose properties and check the click box for Read-only.

Format the public key file

Open rsa.public.yourdomain with a text editor. Remove the header, footer and all carriage returns. Be careful not to remove any other characters! Save this as rsa.public.yourdomain.dkim.

Configure your Sophos for DKIM

On the Sophos, go to Mail Security >> SMTP, select the Advanced tab and scroll down to DomainKeys Identified Mail.

a. Into the Private RSA box, copy the entire content of the rsa.private.yourdomain file including the “armor” (the header, footer etc.).
b. The Key selector we have chosen is simply the four characters dkim.
c. To DKIM domains, add the email domains for which you add TXT records for DKIM to your authoritative public name servers in the next-to-last step below.
d. Don’t forget to click on Apply!

Establish, if necessary, the Sophos as a relayer of email from your mail server

You must do this in order for the Sophos to handle your outgoing email.

a. On the Sophos, go to the 'Mail Security >> SMTP' 'Relaying' tab, add your mail server to Host-based relay and hit Apply.
b. At the bottom of the 'Relaying' tab, select 'Scan relayed (outgoing) messages'
c. On the mail server, add the IP of the Sophos as the smart host.
d. On Exchange 2003, open Exchange System Manager:

i. In 'Administrative Groups', open an appropriate administrative group and select 'Connectors'.
ii. Right-click on the 'SMTP Connector' and select 'Properties'.
iii. On the General tab, click on ‘Forward all mail through this connector to the following smart hosts’ and enter with brackets, the internal interface IP of the Sophos. For example: [10.1.1.21]

Configure (or have configured) your DNS entires

For each domain hosted through the Sophos with which you want to use DKIM, have the relevant nameserver admin add the following lines to your DNS entries.

Use a “-” in place of a “~” in the first record if email sent from yourdomain.com always will have a correct DKIM signature:

    	_domainkey.yourdomain.com			IN	TXT	o=~  

Replace *** with the contents of rsa.public.yourdomain.dkim and beginning in testing mode (t=y):  

	dkim._domainkey.yourdomain.com		IN	TXT	v=DKIM1; k=rsa; t=y; p=***

 Test your work and finalize your DNS record   
Send a blank email to 'check-auth@verifier.port25.com', and you will receive an automated response that should include “DKIM check: pass”.  
You now should go back to the previous step and remove the testing flag (t=y;) from your DNS record.
Within a few hours after your name server admins have made the final change(s) to your DNS records, you will be a full member of the DKIM community. 

Attribution:

This article was submitted by Robert H. Alfson (Bob), MediaSoft Inc.