aaPanel_Kern
Thanks for the reply!
OS / version: Ubuntu 24.04.4 LTS, aaPanel 8.0.2.
A few notes on your points:
1. „This directory and files should have permissions of 755"
The directory was always 755 root:root - that wasn't the issue. The aaPanel file-browser displays „755 / root" for the entries, but on the actual filesystem the files showed:
-rw-r----- root root default.private (mode 640)
-rw-r--r-- root root default.pub (mode 644)
For the private key, mode 640 (or 600) is correct — setting it to 755 (-rwxr-xr-x) would make it world-readable, which would be a security regression. The mode wasn't the issue.
2. „Incomplete initialization" - possible context
That's plausible: my setup has been migrated across several aaPanel versions over the years, and DKIM keys carry timestamps as old as Oct 4 2022 (probably aaPanel 6.x back then). Newer keys created via the current 8.0.2 mail module show the same ownership pattern, though, so the behavior seems consistent across versions on my side.
All 8 of my mail domains were affected uniformly, with the same Rspamd log entry for each:
dkim_module_load_key_format: cannot load dkim key
/www/server/dkim/<domain>/default.private:
cannot map key file: '...default.private' Permission denied
3. The actual cause I found
Rspamd (running as user _rspamd, configured as the milter on 127.0.0.1:11332) couldn't read the key file because:
- Owner / group of the key:
root:root
_rspamd is not a member of root- Mode 640 on
root:root means only root and root-group members can read
So Rspamd silently produced unsigned outbound mail - DNS/SPF/DKIM-record checks were all green, but actual messages went out without a DKIM-Signature: header. Postmaster Tools complained accordingly.
4. Fix that worked
chgrp _rspamd /www/server/dkim/*/default.private
chmod 640 /www/server/dkim/*/default.private
systemctl reload rspamd
Immediately after: Gmail auth-results changed from dkim=none to dkim=pass header.i=@<domain>.
5. Suggestion (for completeness - could already be fixed in newer setups)
When the mail module generates DKIM keys, it would be safer to set the group right away, e.g.:
install -o root -g _rspamd -m 640 default.private /www/server/dkim/<domain>/
or chgrp _rspamd immediately after key generation. Then the user that needs to read the key actually can, without loosening the mode.
If this is already the default in fresh 8.0.2 installs and only legacy setups like mine carry over the wrong group from older versions, a one-time „fix permissions" routine in the mail module would help users in the same boat.
Thanks again for looking into it!
PS: You might still remember - I once gave you SSH access to this host (it's a VPS) to fix an issue back then.
