Create a DKIM TXT record
Domain Keys Identified Mail (DKIM) helps you protect your company fromemail spamming and phishing attempts. It provides a method forvalidating a domain name identity that is associated with a messagethrough cryptographic authentication.
For a complete description of DKIM, see the link to recommended DKIM sitesin the “External resources” section at the end of this article.
Note: The method described in this article differs from the way DKIM isset up for Rackspace Hosted Email and Exchange customers. If you are aRackspace Email, Hosted Exchange, or Office 365 customer, contact theRackspace Cloud Office team for help configuring the proper DKIM, DMARC, andSPF records.
Using CngKey to Generate RSA key pair in PEM (DKIM compatible) using C# similar to “openssl rsa”. Is it possible to generate an RSA key pair, export that into ASN1 format compatible with DKIM's PEM-like format, using only C#? Here is code for the Microsoft CNG provider with the.NET dll on codeplex (above).
The process of setting up DKIM involves the tasks detailedin the following steps:
- Generate a DKIM Core Key. Enter the domain you'd like to generate keys for, for example dkimcore.org and hit the button. This online wizard is fine for generating keys for testing and evaluation. If you decide to use DKIM Core in production, though, you might want to consider the security risks.
- DKIM Wizard This wizard will allow you to easily create a public and private key pair to be used for DomainKeys and DKIM signing within PowerMTA™. The key pair will be used for both DomainKeys and DKIM signing.Policy records are no longer included as they are part of the deprecated DomainKeys, and not DKIM.
- That generates a 2048-bit RSA key pair, encrypts them with a password you provide and writes them to a file. You need to next extract the public key file. You will use this, for instance, on your web server to encrypt content so that it can only be read with the private key.
- Generating keys using OpenSSL There are two ways of getting private keys into a YubiKey: You can either generate the keys directly on the YubiKey, or generate them outside of the device, and then importing them into the YubiKey.
- Mar 30, 2015 Now you can start OpenSSL, type: c:OpenSSL-Win32binopenssl.exe: And from here on, the commands are the same as for my “Howto: Make Your Own Cert With OpenSSL”. First we generate a 4096-bit long RSA key for our root CA and store it in file ca.key.
- Choose a DKIM selector.
- Generate a public-private key pair.
- Publish the selector and public key by creating a DKIM TXT record.
- Attach the token to each outgoing email.
What is a DKIM selector?
A selector is specified as an attribute for a DKIM signature and is recorded in the DKIM-Signature header field.
Because DKIM selectors give different DNS query names, the system uses the selector as an additional name component for validation. Under each domain name, there might be one too many unique DKIM DNS records associated with different selectors.
Selectors enable multiple keys under a domain name, which can provide separate signatory controls among departments, date ranges, or third parties acting on behalf of the domain name owner. No two services or products should use the same selector.
A selector can be anything you want, such as a word, number, or a string of letters and numbers.
Openssl Generate Dkim Key
For example, if you choose
oct2019
for your selector, the domain name wouldbecome oct2019._domain.example.com
.Before you begin
Before you log in to the control panel and create a DKIM record, there area couple of things that you need:
- Choose a simple, user-defined text string to be your DKIM selector. Theselector is appended to the domain name to help identify the DKIM publickey. See the previous section for more information about choosing aDKIM selector.
- Generate a public-private key pair by using a tool such as ssh-keygen onLinux or PuTTYgen on Windows. For help creating key pairs, seeGenerate RSA keys with SSH by using PuTTYgen.
Create a DKIM TXT record
Use the following steps to create a DKIM TXT record in the Cloud ControlPanel:
- Log in to the Cloud Control Panel.
- In the top navigation bar, click Select a Product > Rackspace Cloud.
- Select Networking > Cloud DNS.
- Click the gear icon next to the name of an existing domain andselect Add DNS Record.
- In the pop-up dialog box, select TXT Record as the record type.
- In the Hostname text box, enter the selector text string that you chosein Step 1, followed by the literal string
._domainkey
. For example, if youuse the default as the text string, you enterdefault._domainkey
in theHostname text box. - Expand the Text box by dragging the corner, and then enter thefollowing information, pasting the public key that you generated in theprevious section after the
p=
prompt:When you finish, the TXT record looks similar to the followingexample: - Click Add Record.
The DKIM TXT record is added to your domain.
Use Openssl To Generate Key Pair
For instructions about attaching the token to your outgoing email, see theSpecification section at DKIMcore.org.
Related articles
External resources
Experience what Rackspace has to offer.
©2020 Rackspace US, Inc.
Except where otherwise noted, content on this site is licensed under a Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported License