Emails not getting signed by DKIM when sent using discourse

installation
1

I have discourse installed on VPS
I have directadmin installed on a different managed VPS running exim smtp

In discourse I used SMTP server details on the directadmin VPS

I checked emails with isnotspam.com

Sending email using thunderbird with directadmin SMTP

Result: pass
ID(s) verified: [header.From=discourse@example.com](mailto: header.From=discourse@example.com)
Selector=x
domain=example.com
DomainKeys DNS Record=x._domainkey.example.com

BUT if I send it out using discourse the result passes, but no selector

Result: pass
ID(s) verified: [header.From=discourse@example.com](mailto :header.From=discourse@example.com)
Selector=
domain=
DomainKeys DNS Record=._domainkey.

Any ideas?

2

Which component are you expecting to be doing the DKIM signing?

1 Like
3

My SMTP server should.

However when emails are sent from discourse it’s not getting signed the same.

I’m wondering if it has to do with the helo forum.example.com

4

You gave the answer yourself :sunglasses: Discourse acts as an smtp client and the dkim signing must be provided by the smtp server receiving the mails from Discourse.

5

Yes correct.

So the different signing results when checked with isnotspam was confusing me.

Anyway , I re ran the test today and now it passes

–

----------------------------------------------------------
DKIM check details:
----------------------------------------------------------

Result: pass
ID(s) verified: header.From=discourse@example.com
Selector=x
domain=example.com
DomainKeys DNS Record=x._domainkey.example.com

Not sure what happened, but I did have to update my DNS txt key inside cloudflare, as well as update the rDNS for the mail server.

Maybe it just required time for everything to propagate or clear some cache?

6

In the previous test:

Result: pass
ID(s) verified: [header.From=discourse@example.com](mailto :header.From=discourse@example.com)
Selector=
domain=
DomainKeys DNS Record=._domainkey.

there was no DKIM record, so it wasn’t signed.

DNS doesn’t propagate, remember.

Regardless, now the mail is signed so you should be good?

7

Yep its signs on checking, so something needed cache updating