I have 2 NIC's with 2 different ISP's (so 2 different IP's). Let's call ISP 1 "WAN 1" and ISP 2 "WAN 2". I'm not allowed ( I can't send or receive) to use a mailserver on WAN 1, so I can only use WAN 2 to send and receive mail. I've enabled Uplink balancing set WAN 1 as first and WAN 2 as second and auto monitoring. Then I made a Multipath Rule: Any->SMTP->Any (by Interface)-> WAN 2.
Then I used the DKIM how to from the Knowledge base and followed all the steps and tests and that worked fine. I have 3 domains which I use. On all zones of the domains I copied the public key, so this should not be a problem.
I can send and receive mail. But when I send to my account at Yahoo.com (which supports Domain Keys) it shows the following:

From Me Wed Apr 8 20:45:36 2009
Return-Path: <prvs=03493db58c=me@mydomain.com>
Authentication-Results: mta170.mail.re4.yahoo.com from=mydomain.com; domainkeys=neutral (no sig); from=; dkim=temperror(d2i_PUBKEY_bio() failed)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mydomain.com; s=dkim; h=Fromate:To:Message-ID:Subject:
MIME-Version:Content-type; bh=9LQyMGjDaGPWKTjCng3s3gwVUvcAIHW4dU
IjbM/m2XA=; b=rjGVsjRn6ZSDWE3KZ2OCWnR+z5j+Xd4FIqyMM5Zlir+288q2 9f
y8ZPuW+69yiuZ82TZeUw4UIFBSIeO3qfPGL8z9emLCAwztA4Pz g2B5RwGjnYjqux
w5yCtstU7uO6c8CA4FHvULRUr5cqzIIdq3W7KlDwrYwjn8h0N5 E1tX3hU=

Also when I send a test e-mail to sa-test@sendmail.net and get the following error:
Authentication System: DomainKeys Identified Mail
Result: DKIM signature confirmed BAD
Description: Unrecoverable error during processing; signature data cannot be verified
Reporting host: sendmail.net
More information: Domain Keys Identified Mail (DKIM)
Sendmail milter: https://sourceforge.net/projects/dkim-milter/

Does anyone know where this problem is caused, so in Astaro or on my DNS server?

Fobe, did this work correctly before you enabled Uplink Balancing?

__________________
ACE V7 - Astaro Preferred Partner since V3
Addicted to my iPhone!

Not tried, because WAN 2 is added later and I can't use/test e-mail traffic on WAN 1. But I think what you're idea is: disable WAN 1 and then use only WAN2 and see if the error is still there, am I right?

Good idea. I was just trying to eliminate that as a cause, and if it had worked before, that would have done it.

From my understanding, DKIM shouldn't depend on the sender's IP like SPF does.

I created a "Configuring DKIM" document last year that's probably too elementary for you, but reading it might give you an idea. Click on my name to send me an email, and I'll send it to you. I would appreciate any suggestions/corrections.

Cheers - Bob

__________________
ACE V7 - Astaro Preferred Partner since V3
Addicted to my iPhone!

oooops, I just found out what the problem is! In my private key where still some "/" which I didn't see (it's very small) in the 1st place... Now everything is working fine!

Well, it looks that DKIM is working but when I send a test e-mail to auth-results@verifier.port25.com, I get the following report:

Authentication-Results: verifier.port25.com smtp.mail=fobe@mydomain.com; mfrom=pass;
Authentication-Results: verifier.port25.com header.From=fobe@mydomain.com; domainkeys=neutral (message not signed);
Authentication-Results: verifier.port25.com; dkim=neutral (message not signed);
Authentication-Results: verifier.port25.com header.From=fobe@mydomain.com; pra=pass;

Why do I get "dkim=neutral" and not "pass" and why is it "not signed"? Is this normal? Can someone explain this...?

Send me an email directly. The last one you sent didn't have a DKIM signature.

__________________
ACE V7 - Astaro Preferred Partner since V3
Addicted to my iPhone!

I'm getting the same error "dkim=temperror(d2i_PUBKEY_bio() failed)" for my settings...

You did't repeat the entire error message line. fobe had a configuration problem that resulted in his emails not being DKIM signed.

Cheers - Bob

__________________
ACE V7 - Astaro Preferred Partner since V3
Addicted to my iPhone!

Astaro was not including the DKIM-Signature unless the private key included the prologue/epilogue:

-----BEGIN RSA PRIVATE KEY-----
***
-----END RSA PRIVATE KEY-----

in contrast to the DNS TXT record where only the raw public key is specified (i.e., a continuous string without the prologue/epilogue)