title: Your message is not signed with DKIM
body: <p>I am writing my application in nodejs. At this stage, I'm trying to send emails to the mail-tester.com test environment to see if my emails go to spam, and I'm getting this error: 'Your message is not signed with DKIM'.</p>
  <p>I am using AApanel, first I uploaded my project and clicked the SSL button, AApanel using Let's Encrypt generated the necessary certificates and keys for me, but did not generate the public key</p>
  <p>[my key and cert here] <a href="https://i.stack.imgur.com/8yqIo.png" rel="nofollow noreferrer">https://i.stack.imgur.com/8yqIo.png</a></p>
  <p>I copied my private key in order to create a public key based on it, I went into OpenSSL and entered the command:</p>
  <pre><code>openssl rsa -in dkim_private.pem -pubout -outform der 2&gt;/dev/null | openssl base64 -A
  </code></pre>
  <p>Next, I got my public key from the private.</p>
  <p>[here is how i set up my public key]<a href="https://i.stack.imgur.com/hNgdh.png" rel="nofollow noreferrer">https://i.stack.imgur.com/hNgdh.png</a></p>
  <p>Here is my dkim on domain:</p>
  <pre><code>v=DKIM1;k=rsa;p=MIIB...
  </code></pre>
  <p>where after the P-tag, there is a public key obtained using OpenSSL.</p>
  <p>So the next is my script to send a message:</p>
  <pre><code>     const tls = require('tls');
       const fs = require('fs');
       const net = require('net');
       const ConvertForSMTP = require('./tools/conv.js');
  
       const options = {
           key: fs.readFileSync('./keys/my-key.pem'),
           cert: fs.readFileSync('./keys/my-cert.pem'),
           isServer: false
       };
  
       let netSocket = net.createConnection(25, 'reception.mail-tester.com');
  
       netSocket.on('ready', () =&gt; {
           netSocket.write('EHLO hailmail\r\n');
           netSocket.write('STARTTLS\r\n');
       });
  
       netSocket.on('data', (chunk) =&gt; {
           const res = chunk.toString();
           console.log(res);
           if (res.includes('220 2.0.0 Ready to start TLS')) {
  
               let secure = upgrade(netSocket);
  
               secure.on('secureConnect', () =&gt; {
                   let caretka = `\r\n`;
                   console.log(secure.authorized);
                   console.log('IN SECURE');
  
          secure.write('EHLO hailmail\r\n');
  
          secure.on('data', chunk =&gt; {
              const response = chunk.toString();
              console.log(`Res in secure: ${response}`);
  
              if (response.includes('221 2.0.0')) {
                  secure.destroy()
              }
              else if (response.includes('354')) {
  
                  selectorBody(response, function (value) {
                      console.log(`sending data: ${value}`);
                      secure.write(value + caretka);
                  });
  
                  secure.write(`.\r\n`);
              }
              else {
                  let request = selectorHeader(response);
                  secure.write(request + caretka);
              }
  
          })
          secure.on('keylog', (line) =&gt; {
              console.log(`Line in secure: ${line}`);
          })
          secure.on('close', () =&gt; {
              console.log('closed');
          })
      });
  }
  
  });
  
   function selectorBody(res, cb) {
       let command = ConvertForSMTP('buw123.c@hailmail.co.uk', 'test-am6gm86w1@srv1.mail-     tester.com', 'TEST', 'THIS IS A TEST MESSAGE FROM HAILMAIL.CO.UK');
       if (res.includes('End data with')) {
           console.log('in 354');
           for (let key in command.data) {
               cb(command.data[key]);
           }
      }
   }
  
   function selectorHeader(res) {
       let command = ConvertForSMTP('buw123.c@hailmail.co.uk', 'test-am6gm86w1@srv1.mail-          tester.com', 'TEST', 'THIS IS A TEST MESSAGE FROM HAILMAIL.CO.UK');
      if (res.includes('250-mail-tester.com')) {
           console.log(`sending ${command.mailFrom}`);
           return command.mailFrom;
       }
       else if (res.includes('250 2.1.0')) {
           console.log(`sending ${command.mailTo}`);
           return command.mailTo;
       }
       else if (res.includes('250 2.1.5')) {
           console.log(`sending ${command.commandData}`);
           return command.commandData;
       }
       else if (res.includes('250 2.0.0')) {
           return command.commandQuit
       }
      else {
           return command.commandQuit
       }
   }
  
  function upgrade(skt) {
  skt.removeAllListeners('data');
  skt.removeAllListeners('error');
  skt.pause();
  return tls.connect({ socket: skt, secureContext: tls.createSecureContext({ key: options.key, cert: options.cert }), rejectUnauthorized: false }, () =&gt; {
      console.log('tlsSocket in the game');
  });
  }
  </code></pre>
  <p>So I use the let's encrypt certificate and private key when I do socket.upgrade (which happens after starttls), but still mail-tester doesn't see my use of the DKIM signature. Maybe someone faced with this, tell me. If I missed something, ask, I will add the code</p>
  <p><strong>EDIT:</strong> So for the first never make the same mistake as i made. Certbot (Let's ecnrypt) doesn't create the certificate for DKIM signing, you can check this out here: <a href="https://certbot.eff.org/faq#can-i-use-certificates-from-certbot-for-code-signing-or-email-encryption" rel="nofollow noreferrer">certbot doc</a></p>
  <p>You should use another service, like DKIM generator, you will get there PRIVATE RSA KEY, PUBLIC KEY, and even ready-to-post DKIM-record for your domain. I wanted to create myself DKIM signing functionality, but i found better variant for nodejs, it calls <a href="https://github.com/postalsys/mailauth" rel="nofollow noreferrer">mailauth</a></p>
  <p>And as said Patrick Mevzek, in rfc <a href="https://datatracker.ietf.org/doc/html/rfc6376#appendix-A.3" rel="nofollow noreferrer">6376</a> you can find the example of a letter, and there is a DKIM-Signature line, which you can get, using mailauth.</p>