Since setting up and moving to our new server, we had problems sending e-mails to other people. Mails did get marked as spam on the other side, and got moved to the Spam folder, or their subject got a prefix like [SPAM] $subject.
I remembered that while setting up a mail server at work, I used mail-tester.com to check my mails for problems. I sent a mail to them and ... got 6/10 points: The DKIM signature was invalid.
I'm using rspamd as milter in Postfix:
smtpd_milters = inet:localhost:11332 non_smtpd_milters = inet:localhost:11332
and rspamd is configured to add DKIM signatures:
path = "/var/lib/rspamd/dkim/$selector.key"; selector = "2019"; ### Enable DKIM signing for alias sender addresses allow_username_mismatch = true;
Now I compared the contents of /var/lib/rspamd/dkim/2019.txt with the one of my DNS zone /etc/tinydns/tinydns4/root/data-cweiske.de and found that the keys differed!
While setting up the new server, I installed rspamd for the first time. It automatically created new DKIM keys, and I did forget that I also have to update my DKIM DNS entry.
The solution for me was to change the selector to 2020, renaming the files in rspamd's dkim folder from 2019 to 2020, and adding the new 2020 DKIM signature to djbdns' zone configuration. mail-tester gave my mail a 10/10 now.
mail-tester.com only analyzes 3 mails per day per server/IP. If you want more, you have to pay.