﷽
I was in the middle of nowhere when I received a complaint from a staff member in the ERP Department regarding automated emails sent to Gmail addresses that were failing to be delivered.
Our investigation identified the following error:
2026-11-10T15:01:16.648276+07:00 MGWIPORT EEE5C1E19FF: to=<prxxxxxxx12@gmail.com>, relay=gmail-smtp-in.l.google.com[64.233.170.26]:25, delay=2.7, delays=0.05/0/1.5/1.1, dsn=5.7.30, status=bounced (host gmail-smtp-in.l.google.com[64.233.170.26] said: 550-5.7.30 Your email has been blocked because DKIM authentication didn't pass 550-5.7.30 for this message. Gmail requires all email bulk senders to 550-5.7.30 authenticate their email with DKIM.
The error indicates that Gmail rejected the email because DKIM authentication failed. Gmail requires bulk email senders to authenticate their outgoing messages using DKIM.
The proposed solution is to generate a DKIM key pair, publish the DKIM public key as a DNS TXT record, and configure the Mail Gateway to digitally sign all outgoing emails using DKIM.
This will enable Gmail to verify the authenticity and integrity of emails sent from our domain, helping ensure compliance with Gmail's email authentication requirements.
1. Generate DKIM key :
$ sudo apt install opendkim-tools -y
$ sudo mkdir -p /etc/opendkim/keys/rizkym.com
$ cd /etc/opendkim/keys/rizkym.com
$ sudo opendkim-genkey -b 1024 -d rizkym.com -s rizkymdinata
$ sudo cat rizkymdinata.txt
rizkymdinata._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; "
"p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQK....../px5Qd62rlcAUWKSF/Vj5k6n1+1VZI7YyQCQIDAQAB" ) ; ----- DKIM key rizkymdinata for rizkym.com
$ sudo cat rizkymdinata.private
-----BEGIN PRIVATE KEY-----
MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBALgRhA5/gPztKjdo
................
QRgt+/4dgX+X21Bzx31yAPOZOcE7xPJB3HDtEcAO8cd1JXitHbWGW3XyMBRzvIP0
9MsgDIwZS6hmbw==
-----END PRIVATE KEY-----
Next step to publish the DKIM DNS Record, we add the generated DKIM public key as a TXT record in AWS Route 53. If you are using a different DNS provider or DNS server, adjust the configuration steps accordingly to match your DNS environment.
2. Add the record to AWS Route 53 :
AWS Route 53 → Hosted Zones → nabatisnack.co.id → Create record.
Record name : rizkymdinata._domainkey
Record type : TXT
Value :
"v=DKIM1; h=sha256; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQK....../px5Qd62rlcAUWKSF/Vj5k6n1+1VZI7YyQCQIDAQAB;"
TTL (seconds) : 300
Routing policy : Simple routing.
3. Configure Mail Gateway to sign all outgoing mail :
DKIM Signing : Yes
Selector : rizkymdinata
Signing Domain Source : Envelope
Sign all Outgoing Mail : Yes
DKIM Private Key : rizkymdinata.private
If you are using a different Mail Gateway server, adjust the configuration steps accordingly to match your environment.
Barakallahu fiikum
Wa jazakumullahu khair.
No comments:
Post a Comment