From 9722d50b9b6c5ccd81892a00bdd3023399b004fb Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Wed, 5 Dec 2018 15:47:34 +0100 Subject: DKIM: also include the "d=" tag in key filenames, not only the "s=" tag. While the combination of "s=" tag (selector) & "d=" tag signing domain maps to a unique key, the selector alone doesn't necessarily. --- roles/amavis/templates/etc/amavis/conf.d/50-user.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'roles/amavis/templates/etc/amavis/conf.d/50-user.j2') diff --git a/roles/amavis/templates/etc/amavis/conf.d/50-user.j2 b/roles/amavis/templates/etc/amavis/conf.d/50-user.j2 index f3ff416..a09c366 100644 --- a/roles/amavis/templates/etc/amavis/conf.d/50-user.j2 +++ b/roles/amavis/templates/etc/amavis/conf.d/50-user.j2 @@ -33,7 +33,7 @@ $enable_dkim_signing = 1; # Sign *all* outgoing mails with *our* key (yes, amavis complains, but this is # safe as we force our domain with the 'd' tag). {% for x,k in dkim_keys[inventory_hostname_short] | default({}) | dictsort() -%} -dkim_key({{ (x == "~") | ternary('qr/./', "'"+x+"'") }}, '{{ k.s }}', '/etc/amavis/dkim/{{ k.s }}.pem'); +dkim_key({{ (x == "~") | ternary('qr/./', "'"+x+"'") }}, '{{ k.s }}', '/etc/amavis/dkim/{{ k.s }}:{{ k.d }}.pem'); {% endfor -%} @dkim_signature_options_bysender_maps = ( {% for x,k in dkim_keys[inventory_hostname_short] | default({}) | dictsort() %} -- cgit v1.2.3