Will OpenDKIM wildcard configuration work?
Summary
What email marketers say7Marketer opinions
Email marketer from Super User responds that using a single DKIM key for all subdomains with a wildcard is viable but advises caution. If one subdomain is compromised, the DKIM key is compromised for all subdomains.
Email marketer from Reddit suggests that wildcard DKIM records are generally acceptable but recommends monitoring to ensure no unauthorized use occurs. Regularly auditing DKIM keys and configurations is important.
Email marketer from EmailDudes Forum responds that implementing wildcard DKIM can simplify email authentication for numerous subdomains, but it also centralizes the risk. Compromise of the key impacts all subdomains. Regular key rotation is recommended.
Email marketer from StackOverflow shares you have to include the asterisk in both the DNS record and the opendkim configuration. It works if both parts are correctly implemented, allowing for subdomain key usage.
Email marketer from MXToolbox shares that wildcard DKIM records are supported, but careful planning is needed. They suggest testing with a small subset of subdomains before implementing it globally.
Email marketer from SendGrid support explains that wildcard DKIM is supported and reduces the number of records you have to manage. The security implications are that you are putting a lot of trust in 1 key so this must be kept secure.
Email marketer from AuthSMTP notes that you can setup DKIM using wildcard subdomains to make this simpler, they advise that you use a key that has adequate length.
What the experts say3Expert opinions
Expert from Spam Resource explains that while not directly answering about wildcard use, using a single key across multiple domains is a possible alternative to using KeyTable configurations.
Expert from Word to the Wise explains the importance of DKIM setup, but only states this in the context of ensuring that you pass spam filters and land in the Inbox.
Expert from Email Geeks responds that using a wildcard in OpenDKIM configuration might work, but it will attempt to sign for every possible domain passing through Postfix.
What the documentation says6Technical articles
Documentation from Ubuntu Forums notes that wildcard usage in the KeyTable (e.g., `mail._domainkey.*`) is valid and matches any selector. This simplifies the signing process for multiple subdomains using a single key.
Documentation from Oracle explains the process required to configure the DNS and KeyTable records for DKIM using a single DKIM key and wildcard, this simplifies the setup process for subdomains.
Documentation from ServerFault explains using wildcards can simplify DKIM configuration for multiple subdomains. However, it does not indicate it inherently improves or degrades security. Configuration needs to ensure appropriate permissions are set and keys are managed properly regardless of wildcard use.
Documentation from DKIM RFC details how DKIM signing works and specifies the components of a DKIM record. While not explicitly about wildcards, it provides the underlying technical information necessary to understand their implementation.
Documentation from DigitalOcean explains wildcard DKIM records enable you to use a single DKIM key across multiple subdomains, reducing the administrative overhead of managing individual records. However, security best practices still apply.
Documentation from OpenDKIM.org explains that wildcard selectors can be used in the KeyTable file. For example, `mail._domainkey.* *:mail:/etc/opendkim/keys/mail.private` will match any selector under the `mail._domainkey` subdomain.