From 8b98906a94d28bf69afa8910640d44abfd724afb Mon Sep 17 00:00:00 2001 From: Marvin Winkler Date: Mon, 28 Sep 2026 12:23:42 +0200 Subject: [PATCH] dkim: enforce 0600 on private keys at every start MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit opendkim refuses a key that group/others can read ("key data is not secure") and tempfails every message of that domain with 4.7.1. The keys live on the /etc/postfix/additional volume, so their mode is whatever the host left — found 0644 keys on two production gateways, which delayed all outgoing mail of those domains until the sender retried via the other MX. The entrypoint now chmods every opendkim default.private to 0600 on each start (after init, so freshly generated keys are covered as well). Co-Authored-By: Claude Opus 5.5 --- scripts/entrypoint.sh | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/scripts/entrypoint.sh b/scripts/entrypoint.sh index 9ef8d35..f3c07c1 100755 --- a/scripts/entrypoint.sh +++ b/scripts/entrypoint.sh @@ -360,6 +360,18 @@ fi rm -rf /tmp/tls 2> /dev/null cp -a /etc/postfix/tls /tmp/tls +## +# DKIM key permissions — every start +## +# opendkim refuses keys that group/others can read ("key data is not secure") +# and then tempfails every message of that domain (4.7.1). The keys live on a +# volume, so their mode is whatever the host left; enforce it on each start +# (after init, so freshly generated keys are covered too). +if [ -d /etc/postfix/additional/opendkim/keys ]; then + echo ">> DKIM - enforce key permissions (default.private -> 0600)" + find /etc/postfix/additional/opendkim/keys -name default.private ! -perm 0600 -print -exec chmod 0600 {} + +fi + ## # CMD ##