DKIM key generation and DNS fragment generation script.

dkim-generate.bash

#!/bin/bash -eu

# http://www.keylength.com/en/3/ -- ECRYPT II "smallest general purpose level"
# is 1248 bits symmetric; we're pretty stuck on RSA right now
: "${KEYSIZE_RSA:=1248}"

: "${DKIM_SIGN_DOMAINS_FILE:=/etc/exim/dkim/domains-mapping}"
: "${DATE:=$(date +%Y%m)}"

declare -r KEYSIZE_RSA DKIM_SIGN_DOMAINS_FILE DATE
declare -r -a DOMAINS=(
  $( sed -n 's/^\([^\#%][^:]*\):.*$/\1/p' < "${DKIM_SIGN_DOMAINS_FILE}" )
  )

make_for_domain() {
	local -r domain="${1:?need a domain}"
	local -r keyfile="rsa.private.d${DATE}.${domain}"
	local -r dnsfragment="dns.d${DATE}.${domain}"

	if [ -f "$keyfile" ]; then
		echo >&2 "Exists, preserving: $keyfile"
	else
		( umask 027 && openssl genrsa -out "${keyfile}" "${KEYSIZE_RSA}" )
	fi

	if [ -f "$dnsfragment" ]; then
		echo >&2 "Exists, preserving: $dnsfragment"
		return 0
	fi

	export DATE
	openssl rsa -in "$keyfile" -outform PEM -pubout 2>/dev/null | \
		perl > "$dnsfragment" -lne '
next unless /^-----BEGIN/../-----END/;
next if /^-----/; chomp; $str.=$_;
END {$str = qq!"v=DKIM1; k=rsa; p=$str"!; $str =~ s/(.{250})/\1" "/;
print qq!d${ENV{"DATE"}}._domainkey IN TXT $str!}'

	echo "Generated: $keyfile $dnsfragment"
}

for dom in "${DOMAINS[@]}"; do
	make_for_domain "$dom"
done