DKIM Configuration

Overview

Vaultwarden-Plus can sign outbound mail with DKIM before SMTP, sendmail, or SES transport handoff. DKIM improves mail authenticity and deliverability when configured correctly.

Requirements

• Working outbound mail transport.
• DKIM private key material managed securely by the operator.
• Correct DKIM metadata in DKIM_INFOS.

Configuration

Documented settings:

DKIM_PRIVATEKEY=
DKIM_USE_RSA=false
DKIM_INFOS=

DKIM_PRIVATEKEY expects either an Ed25519 seed in base64 by default or an RSA private key when DKIM_USE_RSA=true.

Examples

Enable DKIM only after DNS and key material are prepared. Keep private keys out of Git, issues, screenshots, Wiki edits, logs, and support requests.

Troubleshooting

• Invalid DKIM configuration prevents clean startup.
• DKIM signing does not replace the need for a working SMTP, sendmail, or SES transport.
• Delivery failures can still occur because of provider-side policy, DNS, or credential issues.

Related Pages

• SMTP Configuration
• Troubleshooting

Canonical Documentation

• Environment Template
• Features: DKIM Signing Support
• Security Baseline