How to Retrieve the DKIM Public Key from Plesk Without DNS Installed Make it Rain Paper

Pre-requirements

• Plesk Obsidian 18.0.35 or later installed on your server.
• Administrator access to the Plesk control panel or SSH/RDP access to the server.
• Basic knowledge of DKIM, DNS records, and mail server configuration.
• Access to an external DNS provider to configure the DKIM public key as a TXT record.

Introduction

DKIM (DomainKeys Identified Mail) is a method for email authentication that allows recipients to verify that an email came from the domain it claims to be from. When DNS is not installed on your Plesk server, you can still retrieve the DKIM public key and configure it on an external DNS provider. This guide walks you through the process of extracting the DKIM public key from Plesk and setting it up on your external DNS server.

Step 1: Accessing DKIM Public Key from Plesk UI

If you are running Plesk Obsidian 18.0.35 or later, the DKIM public key is available directly from the Plesk UI.

1. Log into Plesk.
2. Navigate to Domains > example.com > Mail Settings.
3. Click the button to view the DKIM public key, which will appear in a pop-up window.
4. Copy the DKIM public key and proceed to configure it on your external DNS provider as a TXT record.

If the UI method is not an option, follow the steps below to manually extract the DKIM public key via the command line.

Step 2: Extracting DKIM Public Key from the Server (Linux)

If you are using a Linux-based system, follow these steps to retrieve the DKIM public key:

1. Log into the server via SSH:

# For Linux/macOS
ssh root@your-server-ip

# For Windows, use an SSH client like PuTTY.

1. Navigate to the directory where DKIM keys are stored:

cd /etc/domainkeys/example.com/

1. Extract the public key from the private key using the following command:

openssl rsa -in /etc/domainkeys/example.com/default -pubout

1. The output will look like this:

-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBA
---truncated---+
dvFIVlu0MULsWDDJfwIDAQAB
-----END PUBLIC KEY-----

1. Merge the result into one string without newlines, spaces, or formatting issues.

Linux Command to Merge the Public Key into One Line

openssl rsa -in /etc/domainkeys/example.com/default -pubout | tr -d '\n' | tr -d '\r'

Step 3: Add the DKIM Public Key to External DNS

Once you have extracted the public key, add it as a TXT record on your external DNS server. Use the following format:

TXT Record Format

default._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0G--trundacted---C+aOU9Dw2Qedi6qOEcpbGQ3pHV..."

Ensure that the key is correctly formatted as a single string and entered into the external DNS provider's DNS zone for the domain.

Steps for Adding TXT Record in Cloudflare

1. Log into your Cloudflare account.
2. Navigate to the DNS tab and click Add Record.
3. Set the record type to TXT and enter the key in the format shown above.
4. Save the changes and allow time for DNS propagation.

Step 4: Retrieving DKIM Public Key from Windows (MailEnable)

If you're using MailEnable on Windows, follow these steps:

1. Connect to the server via Remote Desktop (RDP).
2. Find the DKIM key in the MailEnable configuration directory by running the following command:

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mail Enable\Mail Enable" | findstr "CONFIG"

1. Once you have the configuration directory path, extract the DKIM public key using the following command (replace the path accordingly):

"%plesk_bin%\openssl" rsa -in "C:\Program Files (x86)\Mail Enable\Config\DKIM\default-example.com.key" -pubout C:\public.key

1. The extracted public key will look similar to this:

-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQ
---truncated---oi4mhhApwZOYq0SEM
zLt5kgMkCY50hNPuNQIDAQAB
-----END PUBLIC KEY-----

1. Merge the public key into one string and copy it into a TXT record for the domain on your external DNS server.

Step 5: Verify DKIM Configuration

Once you've added the DKIM public key to your external DNS server, verify the setup using an online DKIM checker or by sending a test email and checking the DKIM signature in the email headers.

Linux Command to Verify DKIM Signature

# Check DKIM signature in the email headers
grep -i dkim-signature /var/log/maillog

Additional Resources

• Plesk DKIM Configuration Documentation
• Plesk CLI Documentation

Gotchas to Avoid

• Ensure that the key is properly formatted before adding it to your external DNS. Any formatting errors will result in DKIM verification failures.
• DNS propagation may take time, so be patient after updating the TXT record.
• If your server uses a custom DKIM selector, be sure to use the correct selector name (e.g., default._domainkey).

Conclusion

By following this guide, you can easily extract the DKIM public key from your Plesk server, even when DNS is not installed, and configure it on your external DNS provider. DKIM is crucial for improving email deliverability and protecting your domain from email spoofing.

For more detailed instructions on mail and DNS management, visit our Knowledge Base.