DKIM email delivery using Amazon SES using Ubuntu 11.10

This blog post will show you how to add DKIM signatures to your outgoing emails.

You will need:

• An Ubuntu installation(I have tested this on 11.10 but I am sure it works for older versions too)
• An AWS account(There is a free tier version you can use for test more info about how to set it up here  http://br0sk.blogspot.com/2012/02/how-to-get-ubuntu-1110-server-up-and.html ).
• You need access to your DNS setting for your domain and the interface you use has to support TXT records. 
• You need a registered domain name like mydomain.com.

When you run any kind of web application you always want to be able to rely on that the emails the application generates are actually reaching the recipient. You also want it to look like it comes a legit source. Things you want to avoid is that Gmail shows your address like this:

This image is taken from the Gmail help system

Gmail shows the via link if the email has not been properly signed. If we set up AWS SES (Amazons Simple email Service) we will get rid of the word via showing up and next to it an amazon address of some kind.

In order for me to get this running I had to gather information in a few different places. Amazon has a few good help articles but they will not take you all the way. Here is how I got it running.

Setting up the SES account

1. I assume you already have signed up for AWS and can log in to your account. Now go to the SES tab.   In order for you to be able to actually send an email through SES you need to verify the email address for the user you are going to send the emails from. If you are using a standard Ubuntu AMI image that would probably be the user ubuntu@mydomain.com. Now verify that email address according to http://docs.amazonwebservices.com/ses/latest/DeveloperGuide/InitialSetup.EmailVerification.html. While you are at it you can request production access for your SES account so that you can send emails from and to anybody http://docs.amazonwebservices.com/ses/latest/DeveloperGuide/InitialSetup.Customer.html.

2. You will get an email coming in to the email address you are trying to verify. Just click the link in the email to acknowledge that you really want this address to be verified.

3. Create your SMTP credentials like this http://docs.amazonwebservices.com/ses/latest/DeveloperGuide/SMTP.Credentials.html.

Save the credentials in a safe password system. If you lose them you will have to recreate them.

Setup Linux to send email via SES using postfix

4. Install postfix in sattelite mode. It doesn't really matter what settings you chose during the installation we will overwrite the config file soon.

Run;
sudo apt-get install postfix
Follow the instructions.

6. Now follow these instructions http://docs.amazonwebservices.com/ses/latest/DeveloperGuide/SMTP.MTAs.Postfix.html to setup Postfix. Use the STARTTLS based alternative. This is the new way of connecting to SES. The old way demands that you set up a secure tunnel using stunnel. It can still be used but adds an extra layer of complexity.

I had to add this at the end of the main.cf file to get it working properly. If this is not done it will look like you are trying to send an email from your Amazon assigned DNS name and if you haven't verified that address it will not work.

myhostname=mydomain.com


Make sure to add this line as well. It forces emails to your own domain to be delivered through SES. If this is not added Postfix will try to deliver the emails locally bypassing SES(thanks to Ratzai Yaghoub for pointing this out).
This row basically tells Postfix that there are no domains available for local delivery.

mydestination =

Setting up the DNS changes

8. Now we need add the proper TXT records to our DNS. Let's start with SPF. Follow this description: http://docs.amazonwebservices.com/ses/latest/DeveloperGuide/SPF.html

9. Now the same thing but for sender ID: http://docs.amazonwebservices.com/ses/latest/DeveloperGuide/SenderID.html

Setting up DKIM
10. And now the most important one DKIM. This is the entry that will remove the "via" message in Gmail.
This is the guide to follow for that: http://www.pmabox.com/blog/47-sign-emails-with-opendkim-postfix-in-ubuntu-1004-64x

11. When all is done add this to the end of the file /etc/opendkim.conf
OmitHeaders "."
SignHeaders "."Here's why https://forums.aws.amazon.com/thread.jspa?threadID=66252

12. Restart Postfix and you should be ready to go if your DNS changes for DKIM has come through. Do also make sure you restart OpenDKIM afeter making the changes.
sudo /etc/init.d/opendkim restart
sudo /etc/init.d/postfix restart
Final Thoughts
I don't know about you but I don't really think that SES(Simple Email Service) deserves to use the word simple just yet. It would be great if it came with a way of easily get the DKIM signing straight from the service.

Still perfoming the steps above should give you maximum email delivery rates. You can check that in the AWS control panel https://console.aws.amazon.com/ses/home.

Thanks goes out to the people who wrote the articles referenced in the blog post.