WEB WORKBENCH

Virtualmin DKIM Config Guide

A collection of systems, experiments, and builds

Introduction

This guide documents the steps I found necessary to get DKIM signing working correctly on a Virtualmin server running Postfix with multiple virtual domains.
The goal was to allow websites hosted on Virtualmin to send authenticated email using their own domain names.
A common assumption is that if a domain is only sending email and does not need mailboxes, then mail does not need to be enabled.
During testing, I found that Virtualmin needed the domain to be recognised as a mail-enabled domain before the DKIM signing configuration was generated correctly.
This applies even when the domain is only being used for outbound email.

Enable Mail for the Virtual Server

A short intro before the body. Click any field to edit.

For each sending domain:
Go to:
Virtualmin
→ Edit Virtual Server

Enable:
Mail for domain
DNS for domain

This does not mean you must create or use mailboxes.
The purpose is to allow Virtualmin to create and manage the required mail identity and DKIM configuration.

DNS Options Page

Go to:
Virtualmin
→ DNS Options

SPF record enabled = yes

Check:
Allowed sender IPv4 addresses

Make sure your mail server IP address is included.
Example:
51.xxx.xxx.xxx

This should normally match the IP used for your mail server and PTR/rDNS record.
IPv6:
Allowed sender IPv6 addresses

This is optional depending on whether IPv6 mail delivery is being used.

Add DomainKeys Identified Mail records
Select always add dkim records

Click Save

Check the DKIM DNS Record

Go to:
Virtualmin
→ DNS Settings

You should now see the link DNS DKIM record.
Click the DKIM record.
At the bottom of the page, Virtualmin displays the TXT value that needs to be added to your external DNS provider.
Examples:
Cloudflare
Namecheap
Other external DNS providers
If Virtualmin is acting as your DNS server, it will automatically create the required DNS records.

Final DKIM Check

Go to:
Virtualmin Settings (under the virtualserver settings)

Then:
Email Settings
→ DomainKeys Identified Mail Options

Check:
Domains currently signed

Your domain should appear here and thats a very good sign!!

Troubleshooting Discovery

The important discovery was that DKIM signing was not only a DNS issue.
The domain needed to be recognised by Virtualmin as a mail-enabled domain before the DKIM signing configuration was created correctly.
For sending-only domains:
Enable mail for the domain
Enable SPF
Enable DKIM
Confirm the DKIM TXT record
Confirm the domain appears in DomainKeys Identified Mail Options
After this, Postfix can correctly sign outgoing messages.

WordPress SMTP Plugins and the From Address

Another important point is the email address used by your website.
If a WordPress plugin sends mail using a default server address such as:
wordpress@your-server-hostname.com

then the receiving mail system may see a mismatch between:
The visible From address
The DKIM signing domain
The SPF authorised domain
For best results, use a From address that belongs to the website domain.
Example Website:
example.com

Use:
no-reply@example.com

rather than:
wordpress@server-hostname.com

This helps SPF, DKIM and DMARC alignment.

Postfix Sender Canonical Mapping

If you need to rewrite sender addresses globally, Postfix can handle this.
In Virtualmin:
Go to:
Postfix Mail Server → Canonical Mapping → Tables for sender addresses

Add into the input box if using webmin:
hash:/etc/postfix/sender_canonical

Save and apply.
You can then edit the sender canonical map.
Example:
From:
webworkbench@server.webworkbench.co.uk

Maps to:
tudor@webworkbench.co.uk

This helps ensure outgoing mail uses the correct sender identity.

Microsoft Delivery Testing

Microsoft is the mother of all mail tests, win this battle you have a very good mail server!!

A working DKIM setup does not automatically guarantee delivery.
Microsoft services are some of the strictest when it comes to accepting mail from new sending IP addresses.
Before relying on a new mail server, test delivery to a Microsoft consumer mailbox:
Hotmail
Outlook.com
Live.com
If Microsoft consumer mail rejects your server, it is a warning that your sending IP reputation needs attention.
Your server should have:
PTR / reverse DNS
SPF record
DKIM signing
DMARC record
Correct From address alignment

Example Microsoft rejection:
550 5.7.1
Unfortunately, messages from [SERVER IP] weren't sent.
Part of their network is on our block list (S3140)

If you send a test to a hotmail you can use your hotmail or live etc
Visit OLC Support

fill out the form

For Microsoft 365 related deliverability issues:
You can check your IP and request a review here:
Visit Sender Office

Resolve sending to hotmail or live 1st if they block the ip then the vps host is no good for you or change your ip.
Which leads into this.

VPS IP Reputation

One thing often overlooked when building a mail server is the reputation of the IP address.
A new VPS IP does not always start with a clean history.
Some VPS providers allow PTR/rDNS configuration because legitimate mail servers need this, but the same flexibility can also be abused by spammers.
Because of this, some IP ranges may already have a poor reputation before you send your first email.
If Microsoft blocks your IP, you may need to explain:
Who you are
What the server is used for
That email volume is low
That it is for transactional messages
That it is not being used for newsletters or bulk mailing
That SPF, DKIM and DMARC are correctly configured
The aim is to show that the server is a legitimate mail sender.

Summary

For this project, I deliberately selected a lower-cost VPS environment to experience the complete process of building and troubleshooting a mail relay.
This allowed me to work through real-world problems including:
IP reputation
Microsoft filtering
DKIM configuration
Mail deliverability
My production Virtualmin hosting environment is a separate setup and this testing server is not used for normal customer mail.

The main lessons learned:
DKIM is not only about creating a DNS record
Virtualmin needs the domain configured correctly before signing works
The From address matters
SPF, DKIM and DMARC must work together
Passing authentication does not guarantee delivery
IP reputation is just as important as server configuration
A correctly configured mail server still needs a trusted sending reputation.

Found This Useful?

If you found this useful, please consider sharing it.

Published 8th July 2026 By Tudor Gibson

InfoAbout •Cookie info•Contact•FAQs•Terms•Disclosure