Otdfbt

I'm having trouble DKIM signing my outgoing emails when they're sent from an alias domain. That is, when I'm authenticated with user@domain1.com sending as user@domain1.com or somebodyelse@domain1.com my emails are correctly DKIM-signed, but if I send as doejohn@domain2.com the signature is NOT added to the mail header. I'm using postfix and rspamd, here are the relevant files:

Postfix

main.cf

(initial boilerplate omitted for brevity)

virtual_mailbox_domains = pgsql:/etc/postfix/pgsql-virtual-mailbox-domains.cf
virtual_mailbox_maps = pgsql:/etc/postfix/pgsql-virtual-mailbox-users.cf
virtual_alias_maps = pgsql:/etc/postfix/pgsql-virtual-alias-maps.cf
virtual_transport = lmtp:unix:private/dovecot-lmtp
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_tls_security_level = may
smtpd_tls_auth_only = yes
smtp_tls_security_level = may
smtpd_sender_login_maps = pgsql:/etc/postfix/pgsql-virtual-alias-maps.cf
smtpd_milters = inet:127.0.0.1:11332
non_smtpd_milters = inet:127.0.0.1:11332
milter_protocol = 6
milter_mail_macros = i mail_addr client_addr client_name auth_authen

master.cf

(default configs omitted for brevity)

submission inet n - - - - smtpd
 -o syslog_name=postfix/submission
 -o smtpd_tls_security_level=encrypt
 -o smtpd_sasl_auth_enable=yes
 -o smtpd_sasl_type=dovecot
 -o smtpd_sasl_path=private/auth
 -o smtpd_sasl_security_options=noanonymous
 -o smtpd_sender_login_maps=pgsql:/etc/postfix/pgsql-email2email.cf
 -o smtpd_sender_restrictions=reject_unauthenticated_sender_login_mismatch
 -o smtpd_sasl_local_domain=$myhostname
 -o smtpd_client_restrictions=permit_sasl_authenticated,reject
 -o smtpd_recipient_restrictions=reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject

rspamd

local.d/dkim_signing.conf

path = "/var/lib/rspamd/dkim/$domain.$selector.key";
selector_map = "/etc/rspamd/dkim_selectors.map";

Permissions at dkim selectors path are r-x------ for files and r-xr-x--- for folder.

From DKIM signing module's Principles of operation:

The DKIM signing module chooses signing domains and selectors
according to a predefined policy which can be modified with various
settings. Description of this default policy follows: - -

• If authenticated user is present, this should be suffixed with @domain where domain is what’s seen is envelope/header From address

The secondary domain doesn't match the domain of the authenticated user. To alter this default behaviour, your dkim_signing.conf should have:

allow_username_mismatch = true;

.