[Enterprise] DKIM entries when LDAP directory is active

[dennisoderwald]

I noticed that when I have LDAP as my directory and a domain is created via LDAP, no DKIM entries are created.

When I create them via stalwart-cli, they appear.

Am I mistaken, or does it work with the internal directory without running stalwart-cli dkim create <ALGORITHM> <DOMAIN>?

[mdecimus]

You always need to create domains in Stalwart, they are not retrieved from LDAP.

[dennisoderwald]

Thanks for your quick response @mdecimus. However, I am puzzled. Of course, the domains do not come directly from LDAP—but the domains are automatically created via the accounts and displayed in the web interface. So if I were to recreate them via the web interface, wouldn't that result in a duplicate?

It is really confusing what works with LDAP and what doesn't.

[mdecimus]

[...] and a domain is created via LDAP, no DKIM entries are created.

Did you mean created via CLI perhaps?

When you create a domain using the webadmin it sends two requests, one to create the domain and another one to create the DKIM keys. So if you are using the CLI, you need to create the domain and then the DKIM keys.

[dennisoderwald]

@mdecimus I don't create these manually; instead, the domains are created in Stalwart using the accounts that come from LDAP. So I have no influence on this.

Creating the DKIM via CLI is just a workaround I discovered, as they weren't created when they were imported into Stalwart via the LDAP directory.

[mdecimus]

Ah, now I understand what you mean. Yes, the LDAP driver can automatically create any missing domains from the e-mail address but, since generating DKIM keys is an expensive operation, this is not done automatically. If possible it's recommended that you manually add your domains using the webadmin or that you pre-deploy them using the REST API.

[dennisoderwald]

It is precisely these behaviors that deviate from the standard that still feel very clunky and unstable in Stalwart. Neither is this mentioned in the LDAP documentation, nor is it apparent in the WebUI. Just a suggestion to perhaps optimize this. :)

As a first step, it might be useful to include a note in the documentation (https://stalw.art/docs/auth/backend/ldap/) indicating which functionalities are restricted or which workarounds need to be used.

Would it be possible to outsource DKIM generation to a scheduler so that the computationally intensive task is not performed immediately (sync) but is created downstream and no manual intervention via the CLI or via pre-deployment (Rest API) is required?

Update: I've been thinking about your argument again, and I don't quite understand it. Because if I create them via WebUI/RestAPI, isn't it just as computationally intensive? They are created once and only for the domains that don't yet exist in Stalwart (which are created by the LDAP sync), right?

[mdecimus]

That's correct, generating DKIM keys is always a computationally expensive operation. However, Stalwart cannot assume that every new domain requires DKIM signing, so by default it does not automatically generate keys. In fact, when you create a domain via the REST API, no DKIM keys are created automatically.

The only exception is the WebAdmin interface, which does generate DKIM keys automatically as a convenience feature, but this behavior is specific to the WebAdmin tool, not to Stalwart itself. In Stalwart’s core API, the expected workflow always involves two separate steps: first creating the domain, and then explicitly creating the DKIM keys if they are needed.

Additionally, it's worth noting that at present DKIM keys are defined in the configuration file, while domains are managed through the directory. This will change later this year: DKIM keys will move to the database (to avoid large and unwieldy TOML files). When that happens, we plan to introduce an API parameter that will allow you to create a DKIM key for a domain at the time of its creation.