audit 5: the supervisor socket the panel's alone, OpenDKIM logs and oversigns From

M17: the supervisord control socket is root:supervisor 0770, a group whose
one member is the panel; OpenDKIM and Postfix keep `selfpost` for the files
under /data and no longer reach the socket.

L30, read in OpenDKIM 2.11.0~beta2's source first: it logs through
syslog(3) only and has no Logfile option, and nothing in the container
served /dev/log. internal/syslogrelay (the panel binary with
-syslog-relay=/run/syslog/log, program syslog-relay before OpenDKIM,
/dev/log a link to its socket) passes the datagrams to stdout, error and
worse marked. opendkim.conf: Syslog yes, Canonicalization relaxed/simple,
OversignHeaders From (RFC 6376 § 3.4, § 8.15). e2e: OpenDKIM's start line
reaches the container log; every program RUNNING; DKIM verifies.

Tested on the test server: go vet + go test of 26 packages, make e2e (all
pass, 626 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

build/opendkim.conf

@@ -14,10 +14,25 @@
 # dkimf_db_open(): a file or refile table is read line by line; an empty file
 # is an empty table, not an error.)
 
-Syslog                  no
+# Logged through syslog(3) to /dev/log, which the syslog-relay program passes
+# to the container's log (build/supervisord.conf; audit 2026-10-12, L30). The
+# errors are what is wanted - a key that cannot be read, a table that cannot
+# be opened; a line per signed message (SyslogSuccess) is not.
+Syslog                  yes
 UMask                   007
 Mode                    s
 
+# relaxed/simple: the header fields relaxed, so a relay that refolds or
+# respaces one does not break the signature; the body simple, as signed
+# (opendkim.conf.5.in, Canonicalization: header/body, the default
+# simple/simple; RFC 6376 § 3.4). OversignHeaders From lists From: in h= once
+# more than it is present, so a From: added on the way fails the signature
+# instead of being shown above the signed one (opendkim.conf.5.in,
+# OversignHeaders; RFC 6376 § 8.15) - the replay 2.4.0's sender check is
+# about.
+Canonicalization        relaxed/simple
+OversignHeaders         From
+
 # SigningTable uses refile: so the "*@example.com" left-hand patterns match any
 # local-part for a domain; KeyTable maps each domain to its key and selector.
 # (opendkim/opendkim.conf.5.in, SigningTable: with "refile" the keys are