panel-dkim-signing stage 2: OpenDKIM removed

The panel's signer is the only one. Gone: the opendkim package and its
configuration, the syslog-relay and opendkim programs, /dev/log and
/run/opendkim, the reload by USR1 through supervisord
(internal/supervisor/supervisor.go), internal/syslogrelay, the port of
OpenDKIM's From: parser (internal/milter/mailparse.go and its probe,
harness and test/upstream scripts), OPENDKIM_SOCKET and OPENDKIM_DIR.

Keys: internal/domain/keys.go (Keys, NewKeys, DKIM_DIR=/data/dkim) keeps
the keys and writes a selector table, /data/dkim/selectors ("<name>
<selector>"), which the signer reads in place of the KeyTable - it reads
no database, as the sender check reads none. The table is written before
the signer serves (EnsureServerSigned moved there from the notifier).
Keys and table 0600, directories 0700, the panel's. The entrypoint copies
/data/opendkim/keys once, as the panel user, into /data/dkim.new renamed
when whole, and stops the start if the copy fails; /data/opendkim is left
for a rollback to 2.7.x.

Sender check: one RFC 5322 address as a mail program reads it, held
against the bindings; the 256-byte refusal and the texts naming OpenDKIM
go. Allowed() folded the domain through strings.ToLower, which makes the
Kelvin sign a "k" - the comparison with OpenDKIM's reading had hidden it;
it folds ASCII only now.

Health: two dkim-signer rows (applications, notifications) in Milter
sockets, opendkim out of the liveness set; the card no longer takes any
row with a note for the spam filter. Texts as in the design commit.

KILL stays in deploy/docker-compose.yml: measured on the test server,
root without it cannot signal a process of another uid - supervisord
stopping the panel, Postfix's master its children. The plan's "only use
was the reload" was wrong; the comment now gives the real uses.

e2e: one signature, the panel's, verified by dkimpy; the /data/dkim modes;
the OpenDKIM log and process checks, testNeverSignedForAnother and the
cited opendkim, libopendkim11 and libmilter1.0.1 go.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

build/Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 #
-# SelfPost — single Debian-slim image running postfix + opendkim + panel under
+# SelfPost — single Debian-slim image running postfix + panel under
 # supervisord. Build from the repository root:
 #
 #     docker build -f build/Dockerfile -t selfpost:dev --build-arg VERSION=dev .
@@ -52,8 +52,9 @@ ENV DEBIAN_FRONTEND=noninteractive
 # the panel runs (internal/app/sasl.go); that db-util ships that path on
 # trixie is not in a source read here - the image build and the e2e sasldb
 # test say whether it does.
-# opendkim-tools is not installed: nothing in the image runs its programs
-# (DKIM keys are made in Go, internal/domain/dkim.go).
+# No DKIM package is installed: the panel signs itself (internal/milter,
+# sign.go) and makes the keys in Go (internal/domain/dkim.go); OpenDKIM left
+# the image in 2.8.0 (docs/plans/panel-dkim-signing.md).
 # systemd-standalone-sysusers is named so that cron-daemon-common, which
 # logrotate brings (logrotate 3.22.0-1, debian/control: "Depends: cron |
 # anacron | cron-daemon | systemd-sysv"), creates its group with it rather
@@ -65,7 +66,6 @@ RUN echo "postfix postfix/mailname string localhost" | debconf-set-selections \
  && apt-get update \
  && apt-get install -y --no-install-recommends \
       postfix \
-      opendkim \
       sasl2-bin \
       libsasl2-modules \
       db-util \
@@ -94,13 +94,13 @@ RUN printf 'SYNC_CHROOT=\n' > /etc/default/postfix
 # back to it by name on every start, so files of the old ids follow.
 RUN groupadd --system --gid 10999 panel  && useradd --system --uid 10999 --gid panel --no-create-home --shell /usr/sbin/nologin panel
 
-# Shared group bridging the unprivileged services: the panel generates
-# per-domain DKIM keys, application SASL accounts (sasldb2) and the Postfix
-# sender map, while OpenDKIM and Postfix (different users) must read them.
-# Membership in this group - plus setgid dirs under /data (set up in
-# entrypoint.sh) - lets OpenDKIM read the panel-owned keys and lets Postfix
-# read the sasldb2/sender map. (The supervisor control socket has a group of
-# its own, `supervisor`, below.)
+# Shared group bridging the unprivileged services: the panel writes the
+# application SASL accounts (sasldb2) and the Postfix sender map and opens the
+# milter sockets, while Postfix (another user) must read and reach them.
+# Membership in this group - plus setgid dirs under /data and /run/selfpost
+# (set up in entrypoint.sh) - lets Postfix read the sasldb2/sender map and
+# connect to the panel's milters. The DKIM keys are the panel's alone. (The
+# supervisor control socket has a group of its own, `supervisor`, below.)
 # The id is fixed, because the host sees it: an operator gives the TLS
 # private key on the host to this group by number, so that the panel can put
 # it into a full backup (guide § Taking a full backup). It lies outside the
@@ -117,7 +117,6 @@ RUN groupadd --system --gid 10999 panel  && useradd --system --uid 10999 --gid p
 # fail this build rather than share the group.
 RUN groupadd --system --gid 10998 selfpost \
  && usermod -aG selfpost panel \
- && usermod -aG selfpost opendkim \
  && usermod -aG selfpost postfix
 
 # The panel reads the mail queue with `postqueue -p` (and the status page's
@@ -138,14 +137,13 @@ RUN groupadd --system --gid 10998 selfpost \
 # with no_new_privs, execve() no longer changes the gid for a setgid file.)
 RUN usermod -aG postdrop panel
 # The supervisord control socket's group (supervisord.conf, [unix_http_server]):
-# the panel alone - not OpenDKIM's or Postfix's users, which share `selfpost`
-# for the files under /data.
+# the panel alone - not Postfix's user, which shares `selfpost` for the files
+# under /data.
 RUN groupadd --system supervisor \
  && usermod -aG supervisor panel
 
 # Runtime directories: milter sockets and the consolidated persistent root.
-RUN mkdir -p /run/opendkim /run/selfpost /data \
- && chown opendkim:opendkim /run/opendkim \
+RUN mkdir -p /run/selfpost /data \
  && chown panel:panel /run/selfpost /data
 
 COPY --from=build /out/panel /usr/local/bin/panel
@@ -162,7 +160,6 @@ COPY --chmod=0644 internal/web/view/static/OFL.txt /usr/share/doc/selfpost/OFL.t
 # POSIX permissions (e.g. Windows tar sync) cannot land group-writable config
 # that logrotate would silently ignore — see docs/development.md § Building
 # binaries and the image.
-COPY --chmod=0644 build/opendkim.conf /etc/opendkim.conf
 COPY --chmod=0644 build/logrotate-mail.conf /etc/logrotate.d/mail
 COPY --chmod=0755 build/postfix-wrapper.sh /usr/local/bin/postfix-wrapper.sh
 COPY --chmod=0755 build/postfix-reload.sh /usr/local/bin/postfix-reload.sh
@@ -178,7 +175,7 @@ COPY --chmod=0644 build/supervisord.conf /etc/supervisor/supervisord.conf
 # Outbound delivery dials remote MXs on 25 as a client even when inbound is off.
 EXPOSE 8080 465 587 25
 
-# Liveness probe: panel HTTP plus mail-path processes (opendkim, panel, postfix).
+# Liveness probe: panel HTTP plus mail-path processes (panel, postfix).
 # Does not verify TLS, DNS, or end-to-end delivery — see docs/guide.md Operations.
 HEALTHCHECK --interval=30s --timeout=5s --start-period=90s --retries=3 \
   CMD curl -fsS http://127.0.0.1:8080/healthz || exit 1

build/crashexit.py

@@ -5,7 +5,7 @@ If a managed program of the mail path exhausts its restart retries and
 enters FATAL, or keeps crashing - CRASH_LIMIT unexpected exits within
 CRASH_WINDOW seconds - this listener signals supervisord (its parent) to
 terminate, so the whole container exits and Docker's `restart` policy starts it
-again, rather than lingering "alive" with a dead Postfix/OpenDKIM/panel.
+again, rather than lingering "alive" with a dead Postfix or panel.
 FATAL alone did not cover the second: a program reaches FATAL only through
 exits before its startsecs, and one that crashed after it was restarted for
 ever (audit 2026-10-12, L32; supervisor 4.2.5, supervisor/process.py,
@@ -37,10 +37,9 @@ import time
 # Programs whose failure does not take the container down
 # (build/supervisord.conf): logrotate is not on the mail path, postfix-reload
 # runs on demand - a reload it could not start is reported to whoever asked for
-# it - syslog-relay carries OpenDKIM's log lines, not mail, and cert-reload
-# looks for a renewed certificate once a day (a crash of it leaves the one
-# Postfix serves).
-SPARED = {"logrotate", "postfix-reload", "syslog-relay", "cert-reload"}
+# it - and cert-reload looks for a renewed certificate once a day (a crash of
+# it leaves the one Postfix serves).
+SPARED = {"logrotate", "postfix-reload", "cert-reload"}
 
 # CRASH_LIMIT unexpected exits of one program within CRASH_WINDOW seconds are a
 # program that does not stay up. A program on the mail path restarts in

build/crashexit_test.go

@@ -75,7 +75,7 @@ func TestCrashexitCountsCrashes(t *testing.T) {
 	for i := 0; i < 6; i++ {
 		calm = append(calm, exit("panel", "1"), exit("logrotate", "0"))
 	}
-	calm = append(calm, exit("opendkim", "0"), exit("opendkim", "0"), exit("opendkim", "0"))
+	calm = append(calm, exit("postfix", "0"), exit("postfix", "0"), exit("postfix", "0"))
 	if got := runListener(t, calm...); strings.Contains(got, "would shut down") {
 		t.Errorf("expected exits, spared programs and three crashes of another shut down:\n%s", got)
 	}
@@ -89,7 +89,7 @@ func TestCrashexitFatal(t *testing.T) {
 	if got := runListener(t, fatal("postfix")); !strings.Contains(got, "postfix entered FATAL; shutting down") || !strings.Contains(got, "would shut down") {
 		t.Errorf("postfix FATAL:\n%s", got)
 	}
-	if got := runListener(t, fatal("logrotate"), fatal("syslog-relay")); strings.Contains(got, "would shut down") {
+	if got := runListener(t, fatal("logrotate"), fatal("cert-reload")); strings.Contains(got, "would shut down") {
 		t.Errorf("a spared program's FATAL shut down:\n%s", got)
 	}
 }

build/entrypoint.sh

@@ -58,10 +58,11 @@ esac
 # — the one place still running as root — before handing off to supervisord,
 # which starts the panel as the panel user.
 #
-# Mode must stay world-traversable (0755): OpenDKIM and Postfix reach their
-# trees under /data as other users. Go's testing.TempDir is 0700, and a bare
-# chown would leave that mode in place — opendkim then cannot read KeyTable and
-# the container crash-loops (e2e TestHostnameGate/valid_hostname_starts).
+# Mode must stay world-traversable (0755): Postfix reaches its trees under
+# /data as another user. Go's testing.TempDir is 0700, and a bare chown would
+# leave that mode in place — OpenDKIM, which read its tables there until
+# 2.8.0, then could not, and the container crash-looped (e2e
+# TestHostnameGate/valid_hostname_starts).
 # (Go: testing.TempDir uses os.MkdirTemp, src/os/tempfile.go: "created with
 # mode 0o700".)
 chown panel:panel /data
@@ -85,8 +86,8 @@ drop_links() {
 		fi
 	done
 }
-drop_links /data/opendkim /data/sasl /data/postfix /data/antispam /data/log \
-	/data/opendkim/keys /data/opendkim/KeyTable /data/opendkim/SigningTable \
+drop_links /data/dkim /data/dkim.new /data/opendkim /data/sasl /data/postfix /data/antispam /data/log \
+	/data/dkim/keys /data/dkim/selectors /data/opendkim/keys \
 	/data/sasl/sasldb2 /data/postfix/queue \
 	/data/postfix/sender_login_maps /data/postfix/relay_domains \
 	/data/postfix/transport /data/postfix/relay_recipients /data/postfix/tls_policy \
@@ -95,7 +96,8 @@ drop_links /data/opendkim /data/sasl /data/postfix /data/antispam /data/log \
 # under /data; make sure they stay writable without disturbing anything that a
 # later phase deliberately hands to another service. /data/log is exempt: it is
 # deliberately owned by postfix (postlogd writes the delivery log there) and is
-# normalised on its own below, as are the trees shared through group selfpost.
+# normalised on its own below, as are the trees shared through group selfpost
+# and the one OpenDKIM read until 2.8.0, which is left as it was (below).
 # A file's owner is a number: an entry whose user or group is not the panel's
 # by that number - unpacked by root, or written under another image whose
 # image gave the panel other ids (999:999 until 2.7.0, 10999:10999 since) - is
@@ -103,24 +105,31 @@ drop_links /data/opendkim /data/sasl /data/postfix /data/antispam /data/log \
 find /data -mindepth 1 -maxdepth 1 ! -name log ! -name postfix ! -name opendkim ! -name sasl ! -name antispam \
 	\( ! -user panel -o ! -group panel \) -exec chown -R panel:panel {} +
 
-# DKIM key tree. The panel (user `panel`) generates keys and writes
-# the OpenDKIM tables; OpenDKIM (user `opendkim`) must read them. Normalise the
-# tree on every start so it is correct whether /data is fresh, restarted, or
-# just restored from a backup:
-#   - group `selfpost` + setgid on directories so anything the panel creates
-#     inherits the shared group OpenDKIM traverses (inode(7), "The
-#     set-group-ID bit": files created in such a directory take its group);
-#   - private keys and tables group-readable (0640);
-#   - both table files present (empty is fine) BEFORE OpenDKIM starts, so the
-#     daemon comes up cleanly with no domains yet.
-mkdir -p /data/opendkim/keys
-for t in /data/opendkim/KeyTable /data/opendkim/SigningTable; do
-	[ -e "$t" ] || : > "$t"
-done
-chown -R panel:selfpost /data/opendkim
-find /data/opendkim -type d -exec chmod 2750 {} +
-chmod 0640 /data/opendkim/KeyTable /data/opendkim/SigningTable
-find /data/opendkim/keys -type f -name '*.private' -exec chmod 0640 {} +
+# DKIM keys and the selector table, /data/dkim: the panel's alone - it makes
+# the keys, writes the table and signs (internal/domain, Keys; internal/milter,
+# sign.go). Until 2.8.0 the keys were under /data/opendkim, shared with
+# OpenDKIM through group selfpost. The first start without /data/dkim copies
+# them over and leaves the old tree as it was, for an image of 2.7.x rolled
+# back to (docs/plans/panel-dkim-signing.md, Q2). The copy is made as the
+# panel user, which can read nothing there the panel could not, into a
+# directory beside, renamed into place when it is whole: a start that stops
+# midway copies again. A copy that fails stops the start (set -e) - the
+# panel would otherwise make the server's own name a new key, and its
+# published record would no longer match. The selector table is written by
+# the panel before its signer serves (cmd/panel/signer.go).
+# (util-linux 2.41, setpriv(1): --reuid, --regid, --clear-groups; cp(1)
+# -P: never follow a symbolic link in the source.)
+rm -rf /data/dkim.new
+if [ ! -e /data/dkim ] && [ -d /data/opendkim/keys ]; then
+	setpriv --reuid=panel --regid=panel --clear-groups -- \
+		sh -c 'mkdir /data/dkim.new && cp -RP /data/opendkim/keys /data/dkim.new/keys'
+	mv /data/dkim.new /data/dkim
+	echo "entrypoint: the DKIM keys were copied from /data/opendkim to /data/dkim; /data/opendkim is left for a rollback" >&2
+fi
+mkdir -p /data/dkim/keys
+chown -R panel:panel /data/dkim
+find /data/dkim -type d -exec chmod 0700 {} +
+find /data/dkim -type f -exec chmod 0600 {} +
 
 # Application SASL accounts. The panel (user `panel`) writes the
 # sasldb2 via saslpasswd2; Postfix (user `postfix`) reads it to authenticate SMTP
@@ -190,18 +199,16 @@ chown -R postfix:selfpost /data/log
 chmod 2750 /data/log
 find /data/log -type f -exec chmod 0640 {} +
 
-# Milter socket directories. Postfix (user `postfix`) must actually CONNECT to
-# the milter sockets — OpenDKIM's and the panel's — not just probe them at
-# start-up. The sockets are created by the opendkim and panel
-# users respectively, so bridge them to `postfix` through the shared `selfpost`
-# group: group-owned + setgid dirs mean each socket created inside inherits
-# group `selfpost`, and group-traversable (2750) lets postfix reach it. Without
-# this, smtpd cannot talk to OpenDKIM and, because signing is strict
-# (default_action=tempfail), rejects all mail.
-mkdir -p /run/opendkim /run/selfpost
-chown opendkim:selfpost /run/opendkim
+# The milter socket directory. Postfix (user `postfix`) must actually CONNECT
+# to the panel's milter sockets, not just probe them at start-up. The panel
+# user creates them, so they are bridged to `postfix` through the shared
+# `selfpost` group: a group-owned + setgid dir means each socket created
+# inside inherits group `selfpost`, and group-traversable (2750) lets postfix
+# reach it. Without this, smtpd cannot talk to the signer and, because
+# signing is strict (default_action=tempfail), defers all mail.
+mkdir -p /run/selfpost
 chown panel:selfpost /run/selfpost
-chmod 2750 /run/opendkim /run/selfpost
+chmod 2750 /run/selfpost
 # A container that was killed leaves its sockets behind, and a file nobody
 # listens on would satisfy postfix-wrapper.sh's wait: Postfix would start
 # before the sender check does and defer mail until it is there. The check's
@@ -210,18 +217,7 @@ chmod 2750 /run/opendkim /run/selfpost
 # downtime (guide § Health) - a mark left from before would count the whole
 # outage when supervisord cannot say since when Postfix runs.
 # (test(1), -S: true for any socket file, whether or not anything listens.)
-rm -f /run/opendkim/*.sock /run/selfpost/*.sock /run/selfpost/*.alive
-
-# The container's /dev/log: a link to the socket the syslog-relay program (the
-# panel's binary, as `panel`) listens on, so what OpenDKIM logs through
-# syslog(3) reaches the container's log (build/supervisord.conf; audit
-# 2026-10-12, L30). The directory is the relay's and reachable by all: the
-# socket is the container's local log, as /dev/log is on a host.
-mkdir -p /run/syslog
-chown panel:panel /run/syslog
-chmod 0755 /run/syslog
-rm -f /run/syslog/log
-ln -sfn /run/syslog/log /dev/log
+rm -f /run/selfpost/*.sock /run/selfpost/*.alive
 
 # Generate the outbound-relay Postfix configuration from the environment (spec
 # 5). Kept out of the image build so cert paths, rate limits, hostname and the

build/opendkim.conf

@@ -1,60 +0,0 @@
-# OpenDKIM — per-domain signing.
-#
-# Signing is strictly per-domain: each sending domain has its own key pair and
-# selector. The panel generates keys under /data/opendkim/keys/<domain>/ and
-# keeps KeyTable/SigningTable in sync as domains are added or removed, then asks
-# supervisord to send this process SIGUSR1 to reload the tables. (OpenDKIM
-# 2.11.0~beta2, opendkim/opendkim.8.in: on SIGUSR1 the configuration file is
-# re-read; opendkim/opendkim.c, dkimf_config_reload() -> dkimf_config_load(),
-# opens SigningTable and KeyTable again with dkimf_db_open().)
-#
-# Both table files are created (empty) by entrypoint.sh before OpenDKIM starts,
-# so the daemon comes up cleanly on a fresh /data with no domains yet and simply
-# signs nothing until the first domain is added. (opendkim/opendkim-db.c,
-# dkimf_db_open(): a file or refile table is read line by line; an empty file
-# is an empty table, not an error.)
-
-# Logged through syslog(3) to /dev/log, which the syslog-relay program passes
-# to the container's log (build/supervisord.conf; audit 2026-10-12, L30). The
-# errors are what is wanted - a key that cannot be read, a table that cannot
-# be opened; a line per signed message (SyslogSuccess) is not.
-Syslog                  yes
-UMask                   007
-Mode                    s
-
-# relaxed/simple: the header fields relaxed, so a relay that refolds or
-# respaces one does not break the signature; the body simple, as signed
-# (opendkim.conf.5.in, Canonicalization: header/body, the default
-# simple/simple; RFC 6376 § 3.4). OversignHeaders From lists From: in h= once
-# more than it is present, so a From: added on the way fails the signature
-# instead of being shown above the signed one (opendkim.conf.5.in,
-# OversignHeaders; RFC 6376 § 8.15) - the replay 2.4.0's sender check is
-# about.
-Canonicalization        relaxed/simple
-OversignHeaders         From
-
-# SigningTable uses refile: so the "*@example.com" left-hand patterns match any
-# local-part for a domain; KeyTable maps each domain to its key and selector.
-# (opendkim/opendkim.conf.5.in, SigningTable: with "refile" the keys are
-# wildcard patterns matched against the From: address, in file order.)
-KeyTable                /data/opendkim/KeyTable
-SigningTable            refile:/data/opendkim/SigningTable
-
-# The private keys are owned by `panel` and read by `opendkim` through the shared
-# `selfpost` group, so they are deliberately group-readable (mode 0640). That is
-# safe on this single-tenant, private bind mount, but it trips OpenDKIM's default
-# key-safety check, so the check is disabled here by design. (opendkim/
-# opendkim.c, dkimf_checkfsnode(): a key file must be owned by root or by the
-# executing uid, and a group-readable one must be in a group of no other user -
-# `panel` owns these and `selfpost` has three members.)
-RequireSafeKeys         no
-
-# UMask 007 above leaves the socket group read-write (opendkim.conf.5.in,
-# UMask: it applies to the socket); its group is selfpost by the setgid
-# /run/opendkim (build/entrypoint.sh). UserID: the process takes the user's
-# groups (opendkim.conf.5.in, UserID); with Background no and -f
-# (build/supervisord.conf, opendkim.8.in) the supervised pid is OpenDKIM itself.
-Socket                  local:/run/opendkim/opendkim.sock
-PidFile                 /run/opendkim/opendkim.pid
-UserID                  opendkim
-Background              no

build/postfix-config.sh

@@ -178,10 +178,9 @@ need_time MILTER_CONNECT_TIMEOUT "${MILTER_CONNECT_TIMEOUT:-15s}"
 need_time MILTER_COMMAND_TIMEOUT "${MILTER_COMMAND_TIMEOUT:-15s}"
 need_time MILTER_CONTENT_TIMEOUT "${MILTER_CONTENT_TIMEOUT:-30s}"
 
-# Milter sockets: OpenDKIM (signing, strict), the panel's sender check
-# (strict) and its journal-milter (monitoring, fail-open). Fixed container
-# paths, matched by postfix-wrapper.sh.
-OPENDKIM_SOCK="${OPENDKIM_SOCKET:-/run/opendkim/opendkim.sock}"
+# Milter sockets, all the panel's: its journal-milter (monitoring,
+# fail-open), the sender check and the DKIM signer (both strict). Fixed
+# container paths, matched by postfix-wrapper.sh.
 JOURNAL_SOCK="${JOURNAL_MILTER_SOCKET:-/run/selfpost/journal.sock}"
 # The panel's sender check (the From: line against the login, strict).
 SENDER_SOCK="${SENDER_CHECK_SOCKET:-/run/selfpost/sender.sock}"
@@ -400,26 +399,23 @@ postconf -e \
 	"smtpd_client_message_rate_limit=${RATE_MSGS}" \
 	"anvil_rate_time_unit=${RATE_WINDOW}s"
 
-# Milter chain. OpenDKIM signs and is treated strictly (default_action=tempfail:
-# if it is unreachable, defer rather than send unsigned). The journal-milter is
-# monitoring only and is fail-open (default_action=accept): its failure must
-# never block the relay. Per-milter settings use Postfix 3.0+ brace syntax.
+# Milter chain. The sender check comes first and is strict
+# (default_action=tempfail): it holds the From: line against the login, the
+# address a receiver holds the signature to, so a message it could not judge
+# must not be signed. While the panel does not answer on that socket, mail is
+# deferred (docs/security.md).
 #
-# The sender check comes first and is strict as well: it holds the From: line
-# against the login, which is what OpenDKIM then chooses the key by, so a
-# message it could not judge must not reach the signer. While the panel does
-# not answer on that socket, mail is deferred (docs/security.md).
-#
-# The panel's DKIM signer follows the sender check, strict too
-# (docs/plans/panel-dkim-signing.md). Until OpenDKIM leaves the image both
-# sign (stage 1 of that plan): OpenDKIM after the panel, so that every
-# message carries both signatures and the e2e suite compares them.
+# The panel's DKIM signer follows, strict too: unreachable, it defers rather
+# than send unsigned (docs/plans/panel-dkim-signing.md). It signs with the
+# key of the login's domain. The journal-milter is monitoring only and is
+# fail-open (default_action=accept): its failure must never block the relay.
+# Per-milter settings use Postfix 3.0+ brace syntax.
 #
 # non_smtpd_milters is the chain for mail submitted locally with sendmail(1) -
 # the panel's own notifications, sent as postmaster@ the hostname. The
-# signer's own socket for it, and OpenDKIM, sign them with the key of the
-# server's own name; the journal-milter is not on this chain, since they are
-# not an application's mail. Bounces Postfix
+# signer's own socket for it signs them with the key of the server's own
+# name; the journal-milter is not on this chain, since they are not an
+# application's mail. Bounces Postfix
 # generates itself do not pass it (internal_mail_filter_classes is empty).
 #
 # Postfix 3.10.13: html/MILTER_README.html:584, "Different settings for different
@@ -431,8 +427,8 @@ postconf -e \
 postconf -e \
 	"milter_protocol=6" \
 	"milter_default_action=tempfail" \
-	"smtpd_milters={ unix:${SENDER_SOCK}, default_action=tempfail }, { unix:${SIGN_SOCK}, default_action=tempfail }, { unix:${OPENDKIM_SOCK}, default_action=tempfail }, { unix:${JOURNAL_SOCK}, default_action=accept }" \
-	"non_smtpd_milters={ unix:${SIGN_LOCAL_SOCK}, default_action=tempfail }, { unix:${OPENDKIM_SOCK}, default_action=tempfail }"
+	"smtpd_milters={ unix:${SENDER_SOCK}, default_action=tempfail }, { unix:${SIGN_SOCK}, default_action=tempfail }, { unix:${JOURNAL_SOCK}, default_action=accept }" \
+	"non_smtpd_milters={ unix:${SIGN_LOCAL_SOCK}, default_action=tempfail }"
 
 # A signed message is delivered as it was signed: Postfix's SMTP client would
 # otherwise rewrite an 8-bit message as quoted-printable for a server that
@@ -440,8 +436,8 @@ postconf -e \
 # Postfix 3.10.13, src/global/mail_params.h:3088, DEF_DISABLE_MIME_OCONV 0
 # (the conversion is on by default); proto/postconf.proto:7992,
 # disable_mime_output_conversion: "Disable the conversion of 8BITMIME format
-# to 7BIT format". Not set until 2.8.0 - OpenDKIM's signatures were exposed
-# to it as well.
+# to 7BIT format". Not set until 2.8.0 - OpenDKIM's signatures, before the
+# panel's, were exposed to it as well.
 postconf -e "disable_mime_output_conversion=yes"
 
 # What Postfix tells a milter with MAIL FROM: its defaults plus the client's
@@ -456,7 +452,7 @@ postconf -e \
 # Bounded milter timeouts: a *hung* milter (socket accepts but never replies)
 # must fail open just like a crash, not stall mail acceptance until the Postfix
 # defaults (300s content) elapse. With default_action per milter, a
-# journal-milter hang then resolves to accept and an OpenDKIM hang to tempfail,
+# journal-milter hang then resolves to accept and a signer hang to tempfail,
 # but within seconds rather than minutes. Values are well above any healthy
 # response time (signing/DB insert are sub-second), so they never fire in normal
 # operation. The defaults: Postfix 3.10.13, src/global/mail_params.h:3559-3567,
@@ -518,7 +514,7 @@ fi
 # debian/patches/40_chroot_by_default.diff:16: "smtp inet n - y - - smtpd",
 # uncommented; conf/master.cf:12). When both flags are off, remove
 # that listener so port 25 is not an inbound smtpd (outbound delivery uses
-# smtp/unix). When either is on: no SASL, no OpenDKIM; relay accepts only
+# smtp/unix). When either is on: no SASL, no signing; relay accepts only
 # configured domains/recipients; DMARC accepts only allow-listed report addresses.
 if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true" ]; then
 	RELAY_DOMAINS_SETTING=""
@@ -622,8 +618,8 @@ if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true
 			"smtp_tls_policy_maps="
 	fi
 
-	# Milters on port 25. main.cf's chain (OpenDKIM strict + journal-milter) is
-	# for the SUBMISSION path only: OpenDKIM must not gate someone else's
+	# Milters on port 25. main.cf's chain (sender check and signer strict +
+	# journal-milter) is for the SUBMISSION path only: the signer must not gate someone else's
 	# inbound mail (a signing outage would defer it), and the journal-milter
 	# would file inbound mail into the outbound send log under the *sender's*
 	# domain — polluting Deliveries and letting a forged From: consume that

build/postfix-wrapper.sh

@@ -2,8 +2,8 @@
 # Postfix start wrapper: solves the cold-start race where Postfix would try to
 # reach the milter sockets before they are listening.
 #
-# It blocks until the milter sockets — OpenDKIM, the panel's sender check,
-# DKIM signer (two) and journal-milter and, with the inbound relay on, its
+# It blocks until the milter sockets — the panel's sender check, DKIM signer
+# (two) and journal-milter and, with the inbound relay on, its
 # inbound journal milter —
 # are present, then runs `postfix start-fg` and stays its parent. If they are
 # not ready within the timeout it exits non-zero WITHOUT starting Postfix.
@@ -17,10 +17,9 @@
 #
 # This handles cold start only. Once Postfix runs, a milter that does not
 # answer costs what its default_action says (build/postfix-config.sh): mail is
-# deferred for OpenDKIM and the sender check, and passes the journal-milter.
+# deferred for the signer and the sender check, and passes the journal-milter.
 set -eu
 
-OPENDKIM_SOCK="${OPENDKIM_SOCKET:-/run/opendkim/opendkim.sock}"
 JOURNAL_SOCK="${JOURNAL_MILTER_SOCKET:-/run/selfpost/journal.sock}"
 SENDER_SOCK="${SENDER_CHECK_SOCKET:-/run/selfpost/sender.sock}"
 SIGN_SOCK="${DKIM_SIGN_SOCKET:-/run/selfpost/sign.sock}"
@@ -28,7 +27,7 @@ SIGN_LOCAL_SOCK="${DKIM_SIGN_LOCAL_SOCKET:-/run/selfpost/sign-local.sock}"
 TIMEOUT="${MILTER_WAIT_TIMEOUT:-30}"
 INTERVAL=1
 
-SOCKS="$OPENDKIM_SOCK $JOURNAL_SOCK $SENDER_SOCK $SIGN_SOCK $SIGN_LOCAL_SOCK"
+SOCKS="$JOURNAL_SOCK $SENDER_SOCK $SIGN_SOCK $SIGN_LOCAL_SOCK"
 if [ "${INBOUND_RELAY_ENABLE:-false}" = "true" ]; then
 	SOCKS="$SOCKS ${INBOUND_JOURNAL_MILTER_SOCKET:-/run/selfpost/inbound-journal.sock}"
 fi

build/supervisord.conf

@@ -1,8 +1,8 @@
 ; SelfPost process supervision.
 ;
-; Start ORDER is enforced by priority=: OpenDKIM, then the panel (which opens
-; the sender check's and the journal-milter's sockets), then the Postfix
-; wrapper — which additionally blocks until the milter sockets are ready
+; Start ORDER is enforced by priority=: the panel (which opens the sender
+; check's, the DKIM signer's and the journal-milter's sockets), then the
+; Postfix wrapper — which additionally blocks until the milter sockets are ready
 ; before starting Postfix. (supervisor 4.2.5, docs/configuration.rst,
 ; [program:x] "priority": "the start and shutdown ordering"; supervisor/
 ; supervisord.py, runforever(), transitions every group in that order in one
@@ -17,7 +17,7 @@
 ; (supervisor 4.2.5, supervisor/process.py, Subprocess.finish() and
 ; transition()): an exit after it is EXITED and simply restarted, for ever -
 ; which the count of exits covers (audit 2026-10-12, L32). logrotate's,
-; postfix-reload's and syslog-relay's failures are left on Server > Health
+; postfix-reload's and cert-reload's failures are left on Server > Health
 ; (build/crashexit.py).
 
 [supervisord]
@@ -29,12 +29,11 @@ pidfile=/run/supervisord.pid
 loglevel=info
 
 ; The control socket is reachable by the `supervisor` group, whose one member
-; is the panel (the unprivileged `panel` user): it asks supervisord to signal
-; OpenDKIM after it rewrites the DKIM tables, to run the Postfix reload, and
-; for the processes' state. Whoever reaches the socket can stop, start or
-; restart any program, so it is not the shared `selfpost` group's: OpenDKIM
-; and Postfix are in that one for the files under /data, and a fault in either
-; must not reach every other program (audit 2026-10-12, stage 5). Not
+; is the panel (the unprivileged `panel` user): it asks supervisord to run the
+; Postfix reload, and for the processes' state. Whoever reaches the socket can
+; stop, start or restart any program, so it is not the shared `selfpost`
+; group's: Postfix is in that one for the files under /data, and a fault in
+; it must not reach every other program (audit 2026-10-12, stage 5). Not
 ; reachable by world. No HTTP auth is configured because access is gated by
 ; socket permissions, not the network. (supervisor 4.2.5,
 ; docs/configuration.rst, [unix_http_server]: chmod and chown set the socket's
@@ -50,38 +49,6 @@ supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
 [supervisorctl]
 serverurl=unix:///run/supervisor.sock
 
-; The container's /dev/log (a link to the socket below, build/entrypoint.sh):
-; what OpenDKIM - which logs through syslog(3) and nothing else - sends there
-; comes out on stdout, into the container's log (internal/syslogrelay; audit
-; 2026-10-12, L30). Before OpenDKIM, so its first lines are not lost; a
-; message sent while nothing listens is dropped by syslog(3), not queued.
-[program:syslog-relay]
-command=/usr/local/bin/panel -syslog-relay=/run/syslog/log
-user=panel
-priority=50
-autostart=true
-autorestart=true
-startretries=3
-stdout_logfile=/dev/stdout
-stdout_logfile_maxbytes=0
-stderr_logfile=/dev/stderr
-stderr_logfile_maxbytes=0
-
-[program:opendkim]
-; It waits, five seconds at most, for the syslog relay's socket: supervisord
-; starts programs in priority order without waiting for one to be ready, and
-; OpenDKIM's start line would go nowhere (review of audit stage 5). exec keeps
-; the supervised pid OpenDKIM's.
-command=/bin/sh -c 'i=0; while [ ! -S /run/syslog/log ] && [ "$i" -lt 50 ]; do sleep 0.1; i=$((i+1)); done; exec /usr/sbin/opendkim -f -x /etc/opendkim.conf'
-priority=100
-autostart=true
-autorestart=true
-startretries=3
-stdout_logfile=/dev/stdout
-stdout_logfile_maxbytes=0
-stderr_logfile=/dev/stderr
-stderr_logfile_maxbytes=0
-
 ; user=panel also gives the panel its supplementary groups, selfpost and
 ; postdrop (build/Dockerfile): supervisor 4.2.5, supervisor/options.py,
 ; drop_privileges(), os.setgroups() from the user's memberships in
@@ -122,8 +89,7 @@ stderr_logfile_maxbytes=0
 ; One-shot reload helper. The panel runs unprivileged and cannot run `postfix
 ; reload` itself, and it cannot signal the Postfix master directly: `postfix
 ; start-fg` forks a separate master process, so a signal to the supervised
-; foreground process never reaches it (unlike OpenDKIM, which runs in the
-; foreground as the supervised process itself). Instead the panel asks
+; foreground process never reaches it. Instead the panel asks
 ; supervisord — over the group-accessible control socket — to run this program,
 ; which runs the canonical `postfix reload` as root - or exits 75 when no
 ; master runs (build/postfix-reload.sh). autostart is off (it only runs on