---
name: "Mail::SpamAssassin::Plugin::DomainKeys"
section: "3pm"
platform: "linux"
package: "spamassassin"
version: "3.2.5-2+lenny3"
release: "Debian 5.0 (Lenny)"
platforms: ["linux"]
url: "https://new.carta.tech/Mail::SpamAssassin::Plugin::DomainKeys"
---

# Mail::SpamAssassin::Plugin::DomainKeys(3pm)

perform DomainKeys verification tests

## NAME

Mail::SpamAssassin::Plugin::DomainKeys - perform DomainKeys verification tests

## SYNOPSIS

```
 loadplugin Mail::SpamAssassin::Plugin::DomainKeys [/path/to/DomainKeys.pm]
```

Signature:\
  header DK\_SIGNED                *eval:check\_domainkeys\_signed()*\
  header DK\_VERIFIED              *eval:check\_domainkeys\_verified()*

Policy:\
    Note that DK policy record is only fetched if DK\_VERIFIED is\
    false to save a signing domain from unnecessary DNS queries,\
    as recommended (SHOULD) by draft-delany-domainkeys-base.\
    Rules DK\_POLICY\_\* should preferably not be relied upon when\
    DK\_VERIFIED is true, although they will return false in current\
    implementation when a policy record is not fetched, except for\
    DK\_POLICY\_TESTING, which is true if t=y appears in a public key\
    record OR in a policy record (when available).\
  header DK\_POLICY\_TESTING        *eval:check\_domainkeys\_testing()*\
  header DK\_POLICY\_SIGNSOME       *eval:check\_domainkeys\_signsome()*\
  header DK\_POLICY\_SIGNALL        *eval:check\_domainkeys\_signall()*

Whitelisting based on verified signature:\
  header USER\_IN\_DK\_WHITELIST     *eval:check\_for\_dk\_whitelist\_from()*\
  header USER\_IN\_DEF\_DK\_WL        *eval:check\_for\_def\_dk\_whitelist\_from()*

## DESCRIPTION

This is the DomainKeys plugin and it needs lots more documentation.

Note that if the `"Mail::SpamAssassin::Plugin::DKIM"` plugin is installed with `"Mail::DKIM"` version 0.20 or later, that plugin will also perform Domain Key lookups on DomainKey-Signature headers, in which case this plugin is redundant.

Here is author's note from module `"Mail::DomainKeys"` version 1.0:

```
  THIS MODULE IS OFFICIALLY UNSUPPORTED.
  Please move on to DKIM like a responsible Internet user.  I have.
  I will leave this module here on CPAN for a while, just in case someone
  has grown to depend on it.  It is apparent that DK will not be the way
  of the future. Thus, it is time to put this module to ground before it
  causes any further harm.
  Thanks for your support,
  Anthony
```

## USER SETTINGS

- whitelist\_from\_dk add@ress.com \[signing domain name\]

  Use this to supplement the whitelist\_from addresses with a check to make sure the message has been signed by a DomainKeys signature that can be verified against the From: domain's DomainKeys public key.

  In order to support signing domain names that differ from the address domain name, only one whitelist entry is allowed per line, exactly like `"whitelist_from_rcvd"`.  Multiple `"whitelist_from_dk"` lines are allowed.   File-glob style meta characters are allowed for the From: address, just like with `"whitelist_from_rcvd"`.  The optional signing domain name parameter must match from the right-most side, also like in `"whitelist_from_rcvd"`.

  If no signing domain name parameter is specified the domain of the address parameter specified will be used instead.

  The From: address is obtained from a signed part of the message (ie. the "From:" header), not from envelope data that is possible to forge.

  Since this whitelist requires a DomainKeys check to be made, network tests must be enabled.

  Examples:

  ```
    whitelist_from_dk joe@example.com
    whitelist_from_dk *@corp.example.com
    whitelist_from_dk bob@it.example.net  example.net
    whitelist_from_dk *@eng.example.net   example.net
  ```

- def\_whitelist\_from\_dk add@ress.com \[signing domain name\]

  Same as `"whitelist_from_dk"`, but used for the default whitelist entries in the SpamAssassin distribution.  The whitelist score is lower, because these are often targets for spammer spoofing.

## ADMINISTRATOR SETTINGS

- domainkeys\_timeout n (default: 5)

  How many seconds to wait for a DomainKeys query to complete, before scanning continues without the DomainKeys result.