The PhoenixDKIM Home Page

Welcome the PhoenixDKIM project, and thank you for your interest.

What is PhoenixDKIM? It is a mail filter for DKIM signing and verifying, with a focus on security, correctness, and performance on current platforms.

PhoenixDKIM is not a drop-in replacement for OpenDKIM. It began as a modernisation fork, but it has since become a standalone project with its own direction. RSA-SHA1 signing and verifying have been dropped, weak keys are rejected, and a number of legacy features and database backends have been removed or replaced. If you are migrating an existing OpenDKIM deployment, please read the Removed Features page first — your configuration may need changes.

Where the project is heading:

• Security first. As an Internet-facing daemon handling untrusted data from external networks, memory safety is treated as a first-class concern. The codebase is audited on a regular cadence. I am also considering porting the highest-risk parsing code to memory-safe Rust at some point.
• Performance. The signing and verification hot paths are optimised so PhoenixDKIM is not a bottleneck at high mail volumes.
• Strong crypto only. RSA-SHA256 (2048-bit minimum) and Ed25519, via the OpenSSL 3 / LibreSSL EVP APIs.
• DKIM2 readiness. Tracking the emerging DKIM2 specification so support can land when the RFC matures.
• Flexible key storage. Flat-file, LMDB, Lua, Redis, and optional HTTP / Vault backends. The native SQL and LDAP drivers have been retired, but those systems are still reachable: point the HTTP backend at a small custom bridge (in any language) that wraps your SQL or LDAP store, and PhoenixDKIM queries it over HTTP.
• Zero-downtime key rotation. A HashiCorp Vault secret can list several currently-valid selectors, and PhoenixDKIM signs with all of them at once — old and new, RSA and Ed25519 — across the overlap window, so a key rollover needs no flag day. The secret layout matches Rspamd's, so the same store works in both.

PhoenixDKIM was forked from OpenDKIM in early 2026, originally to bring a long-quiet codebase up to date. With thanks to the OpenDKIM authors for the foundation, the project has since grown its own goals and is increasingly its own software — over time the tools, configuration, and identity are moving to the PhoenixDKIM name.

As of 24 May 2026, upstream OpenDKIM has received updates to its develop branch. It remains worth following the original project.

About this website

This website provides information about the PhoenixDKIM source code distribution. When built from source, PhoenixDKIM can run on UNIX-like systems, and has so far been tested by the author on Linux and BSD.