# DKIM Record Publishing — Cloudflare
## Problem
OpenDKIM on Hetzner was signing outbound mail for all 21 client domains correctly (private keys generated, milter running, signatures added to every message) — but the public keys were never published to DNS. This caused Gmail/other recipients to fail DKIM verification, drop the spam score, and quarantine the mail.
Symptom: Wordfence alerts (and other transactional email from Kaburu sites) consistently flagged as spam in Gmail.
## Root Cause
CyberPanel's email installer generates DKIM keys locally and configures OpenDKIM, but does not publish the public key TXT records to Cloudflare. The records at `default._domainkey.<domain>` were either missing or contained the wrong (empty/stale) value.
## Fix Applied (2026-07-30)
Published `default._domainkey.<domain>` TXT records for all 21 Kaburu domains:
- 24hrresponse.com - aberdeenrda.co.uk - bankhousecatering.co.uk - claybusters.scot - dm-ph.com - doctorfin.co.uk - friendscic.org - ggsgenerators.co.uk - jafricasafari.com - kaburu.cc, kaburu.co, kaburu.co.uk - kaburusvr.uk - l8waterhygiene.co.uk - longniddrybowlingclub.com, .co.uk - myretonmarquees.co.uk - pilates-edinburgh.co.uk - thechippyvan.co.uk - touchwell.co.uk - womenunlimited.africa
## Verification
```bash dig TXT default._domainkey.24hrresponse.com +short # Should return: “v=DKIM1; h=sha256; k=rsa; p=MIIBIjA…”
ssh root@kaburusvr 'tail -20 /var/log/mail.log | grep opendkim' # Should show: “DKIM-Signature field added (s=default, d=24hrresponse.com)” ```
## Re-running the Publish Script
Located at: `/root/publish-dkim.sh` on kaburusvr (Hetzner)
What it does: 1. Reads CF token from `/root/.secrets/cloudflare` 2. Lists all zones in the Cloudflare account 3. For each domain in `/etc/opendkim/keys/`:
- Extracts the public key from `default.txt`
- Looks up the zone ID
- Creates or updates the `default._domainkey.<domain>` TXT record
When to re-run: - A new domain is added to the Hetzner server - DKIM keys are regenerated (e.g. by CyberPanel reinstall) - A new site is migrated to the server - DNS records need rotation (every 6-12 months for hygiene)
## Gotchas
- `grep -F “^domain|”` doesn't work — `^` with `-F` treats `|` as literal. Use `awk -F'|' '$1 == d'` instead. Caught on first run. - The script lives on Hetzner because it needs the CF token from `/root/.secrets/cloudflare` and the OpenDKIM keys from `/etc/opendkim/keys/`. Don't move it elsewhere. - DNS propagation: Cloudflare typically serves new records within 1-5 minutes. No need to wait for TTL. - DNSSEC warning (“key not secure”) from `opendkim-testkey` is informational only, doesn't block signing.
## Related
- opnsense — OPNsense firewall (separate email chain, Brevo SMTP fallback) - Wiki: `wiki/infrastructure/opnsense.md` — Unbound/DNS notes - Wiki: `wiki/web/cyberpanel.md` — CyberPanel-specific email setup
## Verification log (2026-07-30)
Before fix: ``` $ dig TXT default._domainkey.24hrresponse.com +short # (empty) ```
After fix: ``` $ dig TXT default._domainkey.24hrresponse.com +short “v=DKIM1; h=sha256; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAi6SuVjoBZaUmtPVD+p6Nel23K5gFpJHfHR5hlM8r73AVjmC7toVZKblrIob0RFhe8xcT1IYS3vE0IECxV8oOlBSEFgKGVPkBvKt9gh3AqvG+LB8yeVOho7lypFScRZiENBE3GO+/Rj3wCjPq19BUn87TsNfB3EHO9IPjUykFACO91nUns0QwJkL…” “W5hu71HjOcExh+qNOumDpE1” ```
Op en DKIM log confirmed signing active throughout: ``` 2026-07-30T18:36:28 opendkim[1538]: 7AE90C5D26: DKIM-Signature field added (s=default, d=24hrresponse.com) … (5 more 24hrresponse.com entries from active brute-force block alerts) ```