FILTER-DKIMSIGN(8)

💅 filter-dkimsign(8) — like, the DKIM signer bestie ✨

okay so before we even start: this is a page from the System Manager's Manual, section 8. yes, the system-y one, the admin girlies' section. buckle up 🎀

---

🦋 NAME

filter-dkimsign — it slaps a dkim signature onto your messages. that's the whole job. that's the gig. no cap. ✨

---

🌸 SYNOPSIS

filter-dkimsign [-tz] [-a algorithm] [-c canonicalization] [-h headers]
                [-x seconds] -d domain -D file -k file -s selector

like look at that flag lineup. -d, -D, -k, -s are the mandatory besties (no brackets, they're required, periodt), everything else is optional glambag content 💖

---

👑 DESCRIPTION

so filter-dkimsign adds a dkim signature to the message. that's it, that's the vibe. here's every flag it supports, in order, no skips, no shortcuts (i would never):

• -a algorithm — the algorithm to use, duh. supported signing algorithms are rsa and ed25519 (and ed25519 only works when it's enabled at compile time, so like… check first 🫶). for hashing, only sha256 should be used, because the other algorithms are most likely not supported by verifiers and you will get left on read. defaults to rsa-sha256.
• -c canonicalization — the canonicalization algorithm used to sign the message. defaults to simple/simple. it's giving minimal effort, and honestly? iconic.
• -D file — file should point to a file containing a list of domains. one domain per line only, please, we are not doing chaos here. see -d for more info.
• -d domain — the domain where the public key can be found. lowkey the main character of this whole operation. you can specify this option multiple times to select the best domain during signing. if you do specify it multiple times, it looks at the domain component of the first mailbox in the from-header and tries to find a match. if no exact match can be found, it looks for the closest parent domain. and if no matches can be found at all? the first domain specified gets used. it's giving "we'll take what we can get" 💀
• -h headers — the email headers which are included in the mail signature. per RFC this option requires at least the from header to be included — that one is non-negotiable, bestie, it's the law. the headers are specified by separating them with a colon. the default is:

from:reply-to:subject:date:to:cc:resent-date:resent-from:resent-to:resent-cc:in-reply-to:references:list-id:list-help:list-unsubscribe:list-subscribe:list-post:list-owner:list-archive

yes it's long. yes it's a whole mood. copy it, don't retype it 🙈

• -k file — file should point to a file containing the RSA private key to sign the messages. guard this one with your life, fr fr 🔐
• -s selector — the selector within the _domainkey subdomain of domain where the public key can be found. little address, big responsibility ✨
• -t — add the time of signing to the dkim header. timestamp slay ⏰
• -x seconds — add the amount of seconds the signature is valid to the dkim header. an expiration date, but make it cute 🎀
• -z — add the mail headers used in the dkim signature to the dkim header. and if you specify a second -z, all headers will be included in the dkim header. useful for debugging purposes 🐛 (this is the "not me debugging at 2am" flag)

---

🫶 SEE ALSO

• smtpd(8)

---

🌈 STANDARDS

• D. Crocker, Ed., T. Hansen, Ed., and M. Kucherawy, Ed., DomainKeys Identified Mail (DKIM) Signatures, RFC 6376, Brandenburg InternetWorking, AT&T Laboratories, and Cloudmark, September 2011.
• J. Levine, A New Cryptographic Signature Method for DomainKeys Identified Mail, RFC 8463, Taughannock Networks, September 2018.

like yes, actual citations. we're academically unbothered but academically correct 💜

---

💖 AUTHORS

• Martijn van Duren <martijn@openbsd.org>

---

real talk before you go: -k holds your private key and -D/-d/-s decide where the world looks for your public key. get the _domainkey part wrong and verifiers will simply not vibe with you. no pressure though 🫶

okay that's the whole page, you ate that 💅 and for the record — this manual's build was Linux 6.12.85-0-lts, dated May 1, 2026. screenshot it, frame it, put it on the fridge ⭐