shop.functionalhtml.com

Mail server (Postfix/Dovecot/Rspamd) is deployed and running on virtual.functionalhtml.com (77.87.246.122) via playbooks/mail.functionalhtml.com.yml.

DNS check for functionalhtml.com (Forpsi zone, ns.forpsi.cz/it/net) shows all records correct except DKIM:

OK:

• A functionalhtml.com -> 77.87.246.122
• MX functionalhtml.com -> mail.functionalhtml.com (prio 100)
• A mail.functionalhtml.com -> 77.87.246.122
• SPF TXT: "v=spf1 mx a ip4:77.87.246.122 -all"
• DMARC TXT: "v=DMARC1; p=quarantine; rua=mailto:f@functionalhtml.com; adkim=s; aspf=s"
• TLSA _25._tcp.mail.functionalhtml.com: present (DANE)

BROKEN:

• pf2023._domainkey.functionalhtml.com is a CNAME pointing to functionalhtml.com itself, so DKIM lookups resolve to the domain's SPF TXT record instead of a DKIM public key. DKIM signature verification will fail for outgoing mail from this domain. Same broken pattern already exists on nakedhtml.com's zone (likely carried over when Forpsi cloned the zone).

On the server only the DKIM private key exists (/etc/opendkim/keys/functionalhtml.com/pf2023.private) - no public key TXT record was ever published.

Fix needed in Forpsi DNS zone for functionalhtml.com:
Delete the CNAME at pf2023._domainkey.functionalhtml.com and replace with a TXT record:

pf2023._domainkey.functionalhtml.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvr6JIrIJKzv0hdz+5QECQEcSg5547thg2yE/xdSkQeZvyFgoFMVeHPu60jVXKd3pv/zoHFMI+vX1oZ8Os2i8wEJxN8plhzqTQHCVjryp7JbLdbzxTdf1eqkCBBhibcHoPRPYHW2/W3C7VkhWFt6HjpMF778bVzjqFm/4PENHZKjD4fj7cwNND1Ac28QIvH8O2tFxyHCc6YLYjDPaq6TE3RnyhGA/qb5s5c7NWhceT8xyc4xGYXNy5N+3IyyiBAJSjAA7yI07YlmWDRgMY/ebmpQBZZwEt/Keol0rTlhUEucXxkfxV+WAAh82RH0UlZjMxtrsJDJOhu3R92o+1dkcKwIDAQAB"

(public key derived via openssl rsa -in pf2023.private -pubout on virtual.functionalhtml.com)

Re-checked twice (last: today) - still broken, not yet fixed in the zone.