Dynamic DKIM Signing in KUMOMTA (as a relay proxy)

get-help
1

I want my outgoing emails to have DKIM signed with the respective EHLO domains provided to my proxies. For example:

Proxy IP: 10.0.0.1, EHLO Domain: ab1.gl.com
Proxy IP: 10.0.0.2, EHLO Domain:ab2.gl.com
Whenever mail is sent from the second IP, the DKIM should be signed with ‘ab2.gl.com’, and similarly for the first IP.

Additionally, I want my received emails to show different ‘mailed-by’ and ‘signed-by’ headers:

Mailed-By: ab2.gl.com
Signed-By: my-original-mail-server
Currently, I can keep these headers static, but I want them to dynamically change based on the outgoing proxy.

Current Headers:

Mail From: gotham@slowgrowth.com
Received From: ab.growth.com (securemail.growth.com [173.233.237.237])
Return Path: no-reply@slowgl.com
Sender IP: 173.233.237.237
Mailed By: slowgl.com
Desired Headers:

Mail From: gotham@slowgl.com
Received From: ab.gl.com (ab.gl.com [173.233.237.237])
Return Path: gotham@slogl.com
Sender IP: 177.233.237.237
Mailed By: ab.gl.com
I want ‘Mailed-By’ to reflect the EHLO domain of the proxy server.

Could you please explain how to define a pool for this configuration?

2

Hey there @natural-frog, thanks for posting. Please read the “Troubleshooting” and “How to Ask for Help” buttons below. If you would like a 1:1 support session from the KumoMTA team, details are at the “Book a Support Session” button below.

3

DKIM is validated based on the From header, you wouldn’t want to DKIM sign based on the return path domain.

4

Also we don’t set a Mailed By header, so I’m not sure where that’s coming from.

5

Here is the Mailed By I’m referring to (in gmail).
As far as i tried i can only set the dkim passing static but i want it to use “ehlo domains” i have assigned to my rotating proxy IP’s .

6

DKIM should be signed by the FROM header. If you really want the signing done on the ehlo domain then you need to change the from header to the ehlo domain before signing.
Alternately , you could do ESP signing using the ehlo domain as shown in the DKIM helper docs.