Received: by 10.66.90.36 with SMTP id bt4mr8927940pab.5.1351478899542;
        Sun, 28 Oct 2012 19:48:19 -0700 (PDT)
MIME-Version: 1.0
Path: s9ni66459pbb.0!nntp.google.com!npeer03.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!border3.nntp.dca.giganews.com!border1.nntp.dca.giganews.com!border4.nntp.dca.giganews.com!border2.nntp.dca.giganews.com!nntp.giganews.com!nrc-news.nrc.ca!goblin2!goblin.stu.neva.ru!newsfeed.xs4all.nl!newsfeed6.news.xs4all.nl!xs4all!post.news.xs4all.nl!not-for-mail
Newsgroups: comp.mail.sendmail
From: Rob <nom...@example.com>
Subject: Re: Sendmail and OpenDKIM
References: <ef026007-c67b-45d6-8c9e-faec45f7a157@googlegroups.com>
User-Agent: slrn/pre1.0.0-18 (Linux)
Message-ID: <slrnk8i847.t5d.nomail@xs8.xs4all.nl>
Date: 25 Oct 2012 11:20:39 GMT
Lines: 30
NNTP-Posting-Host: 2001:888:0:1::888
X-Trace: 1351164039 news.xs4all.nl 6865 [2001:888:0:1::888]:35064
X-Complaints-To: abuse@xs4all.nl
Bytes: 2325
X-Received-Bytes: 2433

mario.zi...@gmail.com <mario.zi...@gmail.com> wrote:
> Hello,
>
> I have run into a problem described in section Sendmail REWRITING FEATURES on http://www.opendkim.org/README:
>
> Due to the way the milter protocol is incorporated into the MTA, opendkim sees the headers before they are modified as required by those two features (MASQUERADE_AS and FEATURE(genericstable)).
> This means the DKIM signature is generated based on the headers originally
> injected by the mail client and not on the headers which are actually sent
> out by the MTA. As a result, the verifying agent at the receiver's side
> will be unable to verify the signature as the signed data and the received
> data don't match.
>
> The suggested solutions to this problem are:
>
> (1) Send mail with the headers already written as needed, obviating the
>     need for these features (or just turn them off).
>
> (2) Have two MTAs set up, either on separate boxes or on the same box.
>     The first MTA should do all of the rewriting (i.e. use these two
>     features) and the second one should use opendkim to add the signature
>     and do no rewriting at all.

I used this solution, but it nicely fits in our existing system.
There is one internal system that holds all the received mail and
makes it accessible to the users (IMAP), and the users have this
system as their default gateway.  This is where all the masquerading
takes place.
This system has a "smarthost" which it sends all mail to, and it is
the system in the DMZ where internet mail is queued and incoming mail
is scanned for spam and viruses.  On that system I implemented OpenDKIM.