DKIM_gen_keys.phps 3.1 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677
  1. <?php
  2. /**
  3. * This shows how to make a new public/private key pair suitable for use with DKIM.
  4. * You should only need to do this once, and the public key (**not** the private key!)
  5. * you generate should be inserted in your DNS matching the selector you want.
  6. *
  7. * You can also use the DKIM wizard here: https://www.port25.com/support/domainkeysdkim-wizard/
  8. * but be aware that having your private key known anywhere outside your own server
  9. * is a security risk, and it's easy enough to create your own on your own server.
  10. *
  11. * For security, any keys you create should not be accessible via your web site.
  12. *
  13. * 2048 bits is the recommended minimum key length - gmail won't accept less than 1024 bits.
  14. * To test your DKIM config, use Port25's DKIM tester:
  15. * https://www.port25.com/support/authentication-center/email-verification/
  16. *
  17. * Note that you only need a *private* key to *send* a DKIM-signed message,
  18. * but receivers need your *public* key in order to verify it.
  19. *
  20. * Your public key will need to be formatted appropriately for your DNS and
  21. * inserted there using the selector you want to use.
  22. */
  23. //Set these to match your domain and chosen DKIM selector
  24. $domain = 'example.com';
  25. $selector = 'phpmailer';
  26. //Path to your private key:
  27. $privatekeyfile = 'dkim_private.pem';
  28. //Path to your public key:
  29. $publickeyfile = 'dkim_public.pem';
  30. if (file_exists($privatekeyfile)) {
  31. echo "Using existing keys - if you want to generate new keys, delete old key files first.\n\n";
  32. $privatekey = file_get_contents($privatekeyfile);
  33. $publickey = file_get_contents($publickeyfile);
  34. } else {
  35. //Create a 2048-bit RSA key with an SHA256 digest
  36. $pk = openssl_pkey_new(
  37. [
  38. 'digest_alg' => 'sha256',
  39. 'private_key_bits' => 2048,
  40. 'private_key_type' => OPENSSL_KEYTYPE_RSA
  41. ]
  42. );
  43. //Save private key
  44. openssl_pkey_export_to_file($pk, $privatekeyfile);
  45. //Save public key
  46. $pubKey = openssl_pkey_get_details($pk);
  47. $publickey = $pubKey['key'];
  48. file_put_contents($publickeyfile, $publickey);
  49. $privatekey = file_get_contents($privatekeyfile);
  50. }
  51. echo "Private key (keep this private!):\n\n" . $privatekey;
  52. echo "\n\nPublic key:\n\n" . $publickey;
  53. //Prep public key for DNS, e.g.
  54. //phpmailer._domainkey.example.com IN TXT "v=DKIM1; h=sha256; t=s; p=" "MIIBIjANBg...oXlwIDAQAB"...
  55. $dnskey = "$selector._domainkey.$domain IN TXT";
  56. //Some DNS server don't like ; chars unless backslash-escaped
  57. $dnsvalue = '"v=DKIM1\; h=sha256\; t=s\; p=" ';
  58. //Strip and split the key into smaller parts and format for DNS
  59. //Many DNS systems don't like long TXT entries
  60. //but are OK if it's split into 255-char chunks
  61. //Remove PEM wrapper
  62. $publickey = preg_replace('/^-+.*?-+$/m', '', $publickey);
  63. //Strip line breaks
  64. $publickey = str_replace(["\r", "\n"], '', $publickey);
  65. //Split into chunks
  66. $keyparts = str_split($publickey, 253); //Becomes 255 when quotes are included
  67. //Quote each chunk
  68. foreach ($keyparts as $keypart) {
  69. $dnsvalue .= '"'.trim($keypart).'" ';
  70. }
  71. echo "\n\nDNS key:\n\n" . trim($dnskey);
  72. echo "\n\nDNS value:\n\n" . trim($dnsvalue);