I just registered after using the site for some time and my registration email from do-not-reply@serverfault.com got marked as spam by my mail server. I have somewhat aggressive settings, but it looks like there's something going on with either the OpenDKIM DNS TXT record or the actual key. My logs are below:

opendkim[14223]: A037FE1605: not authenticated

opendkim[14223]: A037FE1605: bad signature data

postfix/qmgr[7489]: A037FE1605: from="do-not-reply@serverfault.com"

Here is the relevant header info from the message

<br><br>Authentication-Results: dkim=fail reason="signature verification failed" (1024-bit key) header.d=serverfault.com header.i=@serverfault.com header.b=J2pWFCFJ DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=serverfault.com; s=dk; h=Content-Type:Message-ID:Date:Subject:Reply-To:To:From:MIME-Version; <br> Received: from [] (helo=[]) by mx-out.stackexchange.com with esmtp (Exim 4.72) (envelope-from <do-not-reply@serverfault.com>) id 1Z31fJ-0007sr-TN; Thu, 11 Jun 2015 12:33:01 +0000 –
  • 7
    So you expect Stack Exchange to sign their emails with DKIM and any other thing as soon as it's being developed? I don't think they should. If one want to get emails, he/she shouldn't use super-ultra-aggressive filters. Simple as that. – Shadow Wizard Wearing Mask Jun 11 '15 at 14:14
  • 5
    It's not that I expect the emails to be signed, they are currently being signed and there is an issue with either the DNS record for the signature or the signature itself. – red_shift Jun 11 '15 at 15:31
  • It's nice when DKIM works, but unfortunately all too often it doesn't work. – Michael Hampton Jun 11 '15 at 15:33
  • 7
    This is a valid report that someone could conceivably learn something from - the way red_shift receives email is quite incidental once you consider that. – Tim Post Jun 11 '15 at 17:01
  • What, Tim, you expect people to be polite all the time? ;) – Joe Jun 11 '15 at 17:16
  • 2
    @ShadowWizard If the DNS records or the headers in the mail itself indicates that it is supposed to be signed, then it is sensible to expect the mail to carry a valid signature. – kasperd Jun 14 '15 at 19:58
  • Hmm, yep that should be working right. And does for stackexchange.com but not serverfault.com. I'll take a look at the setup tomorrow. – Zypher Jul 10 '15 at 2:36

This is now fixed. The public key in our dns txt record was wrong for serverfault.com.

I've updated the record and tested that DKIM is now passing.

| improve this answer | |
  • This was some time ago but thank you for fixing the issue! – red_shift Dec 9 '15 at 0:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .