Current File : //var/qmail/man/cat8/qmail-dk.0

Maintenance Procedures                                qmail-dk(8)



NNNNAAAAMMMMEEEE
     qmail-dk - sign/verify and queue a mail message for delivery

SSSSYYYYNNNNOOOOPPPPSSSSIIIISSSS
     qqqqmmmmaaaaiiiillll----ddddkkkk

DDDDEEEESSSSCCCCRRRRIIIIPPPPTTTTIIIIOOOONNNN
     qqqqmmmmaaaaiiiillll----ddddkkkk has the same interface as qqqqmmmmaaaaiiiillll----qqqquuuueeeeuuuueeee  except  that
     it inserts an appropriate DomainKeys header before it queues
     the message.  There are two separate ways to  invoke  qqqqmmmmaaaaiiiillll----
     ddddkkkk.    For   one   way,   you   can  patch  qmail  with  the
     http://qmail.org/qmailqueue  patch  and  set  QMAILQUEUE  to
     point  to  qmail-dk  in  the  environment  when  you send or
     receive email.  For another way, you can rename  qmail-queue
     to qmail-queue.orig, and set DKQUEUE=bin/qmail-queue.orig.

     qqqqmmmmaaaaiiiillll----ddddkkkk supports DomainKey signing  and  verification.   It
     uses the libdomainkey and OpenSSL libraries.  To sign a mes-
     sage, set the DDDDKKKKSSSSIIIIGGGGNNNN environment variable to the pathname to
     the  private  key that will be used to sign the message.  If
     there is a % character in the environment  variable,  it  is
     removed and replaced by the domain name in the From: header.
     If, after substituting the %, that file does not exist,  the
     message  will  not be signed.  If there is no % and the file
     does not exist, the message will be rejected with error  32.
     The  selector  will  be taken from the basename of the file.
     The private key should be created by ddddkkkknnnneeeewwwwkkkkeeeeyyyy,  which  comes
     with libdomainkey.

     To verify a message, set the DDDDKKKKVVVVEEEERRRRIIIIFFFFYYYY  environment  variable
     to  a desired set of letters.  Precisely, if you want a lib-
     domainkey return status to generate an error,  include  that
     letter,  where  A is the first return status (DK_STAT_OK), B
     is the second (DK_STAT_BADSIG), etc.  The letter  should  be
     uppercase if you want a permanent error to be returned (exit
     code 13), and lowercase if you want a temporary error to  be
     returned (exit code 82).

     For example, if you want to permanently reject messages that
     have  a  signature that has been revoked, include the letter
     'K' in the DDDDKKKKVVVVEEEERRRRIIIIFFFFYYYY environment  variable.   A  conservative
     set  of  letters  is  DDDDEEEEGGGGIIIIJJJJKKKKffffhhhh.   Reject permanently BADSIG,
     NOKEY, BADKEY, SYNTAX, ARGS, REVOKED, and  INTERNAL  errors,
     and  temporarily  CANTVRFY  and NORESOURCE.  Add in BBBB if you
     want to reject messages that have a signature  that  doesn't
     verify  (presumably  because the message is a forgery or has
     been damaged in transit.  Note that qqqqmmmmaaaaiiiillll----ddddkkkk always  inserts
     the   DDDDoooommmmaaaaiiiinnnnKKKKeeeeyyyy----SSSSttttaaaattttuuuussss  header,  so  that  messages  can  be
     rejected at delivery time, or in the mail reader.

     Typically, you would sign messages generated on-host by set-
     ting  DDDDKKKKSSSSIIIIGGGGNNNN  in  the  environment  before  running an email



SunOS 5.11                Last change:                          1






Maintenance Procedures                                qmail-dk(8)



     program.  DKSIGN will be carried  through  qmail's  sendmail
     emulation  through qqqqmmmmaaaaiiiillll----iiiinnnnjjjjeeeecccctttt to qqqqmmmmaaaaiiiillll----ddddkkkk.  You would also
     set it for qqqqmmmmaaaaiiiillll----ssssmmmmttttppppdddd at the same time RRRREEEELLLLAAAAYYYYCCCCLLLLIIIIEEEENNNNTTTT is  set,
     most  often in the tcpserver cdb file.  If a host is author-
     ized to relay, you probably want to sign  messages  sent  by
     that host.  DDDDKKKKVVVVEEEERRRRIIIIFFFFYYYY should be set for all other hosts.

     If neither DDDDKKKKSSSSIIIIGGGGNNNN nor DDDDKKKKVVVVEEEERRRRIIIIFFFFYYYY are set, then DDDDKKKKSSSSIIIIGGGGNNNN will  be
     set  to  /etc/domainkeys/%/default.   If  such a private key
     exists, it will be used to sign the domain.

     qqqqmmmmaaaaiiiillll----ddddkkkk will ordinarily spawn qmail-queue, but  if  DKQUEUE
     is  set  in  the  environment, the program that it points to
     will be executed  instead.   If  DKQUEUE  is  not  set,  and
     qqqqmmmmaaaaiiiillll----ddddkkkk   has  been  invoked  as  qqqqmmmmaaaaiiiillll----qqqquuuueeeeuuuueeee  then  qqqqmmmmaaaaiiiillll----
     qqqquuuueeeeuuuueeee....oooorrrriiiigggg is spawned instead.


EEEEXXXXIIIITTTT CCCCOOOODDDDEEEESSSS
     qqqqmmmmaaaaiiiillll----ddddkkkk returns the same exit  codes  as  qmail-queue  with
     these additions:

     33332222   The private key file does not exist.

     55557777   Trouble waiting for qmail-queue to exit.

     55558888   Unable to vfork.

     55559999   Unable to create a pipe to qmail-queue.

SSSSEEEEEEEE AAAALLLLSSSSOOOO
     addresses(5),    envelopes(5),    qmail-header(5),    qmail-
     inject(8),  qmail-qmqpc(8),  qmail-queue(8),  qmail-send(8),
     qmail-smtpd(8)





















SunOS 5.11                Last change:                          2