mirror of
https://github.com/Pro/dkim-exchange.git
synced 2026-04-25 08:55:52 +03:00
[GH-ISSUE #113] Some messages aren't signed correctly #91
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @VictorSvetogor on GitHub (Nov 18, 2015).
Original GitHub issue: https://github.com/Pro/dkim-exchange/issues/113
Hi,
I 've found out that some messages aren't signed correctly. I use 2.1.8 version with Exchange 2010. Sometimes i see on gmail and other mail providers that the mail from my domain has incorrect DKIM.
see here:
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of victor@beloil.by designates 82.209.214.26 as permitted sender) smtp.mailfrom=victor@beloil.by;
dkim=neutral (body hash did not verify) header.i=@beloil.by;
dmarc=pass (p=REJECT dis=NONE) header.from=beloil.by
DKIM-Signature: v=1; a=rsa-sha256; s=corpmail; d=beloil.by; c=simple/simple; q=dns/txt; h=Date : From : Message-ID : Subject : To; bh=EHdx8zaZspFi6uIOK2ZIs8/v4TZnditLkDdpcHL1QII=; b=kpjLFR1jk8UAodbdYVk56o5+iB+mauEv4N+EvUvfGo8qfPYkWWYup58r3iDtoU2J6hN0Prr3VLUmOP517b94n4pC3VWTKw1KeGI5JxMNizvzSElZvSVT/Ww/47D7O9ybqPHxNCylR7YNH//k3ENinnr/aOmleybJKdswAQMpKAM=;
if i remove the attached file (for example) - this message is passes the DKIM test. could you help?
Victor
@stevemayster commented on GitHub (Nov 18, 2015):
Hello Viktor.
Did you install dkim-exchange on edge server or you have a relay server wich faced to internet?
@VictorSvetogor commented on GitHub (Nov 19, 2015):
Hi, stevemayster
it's installed on edge server.
@stevemayster commented on GitHub (Nov 19, 2015):
@VictorSvetogor so message going from edge straight to internet?
I'm asking because i have same issue but i thought it's because i have anti-spam system wich relay mail.
@VictorSvetogor commented on GitHub (Nov 19, 2015):
stevemayster,
yes, messages are going to Internet straight from the edge server.
i have installed Forefront Protection for Exchange on the edge server (it's doing antivirus protection also), but the DKIM signer is installed with lower priority (15). I guess it works with messages AFTER all other exchange transport agents.
[PS] C:\Windows\system32>Get-TransportAgent
@stevemayster commented on GitHub (Nov 19, 2015):
@VictorSvetogor Interesting. I would try to disable FSE on short time and try to send a message.
But, it's your deсision.
@VictorSvetogor commented on GitHub (Nov 20, 2015):
Hi stevemayster ,
I found that the "Attachment Filtering Agent" prevents the correct DKIM signing a message. Once i disabled it - all is ok. But this is not the right solution....
@Pro commented on GitHub (Nov 21, 2015):
@VictorSvetogor does this happen to any e-mail with an attachment or is it dependent on the file type or e.g. file size?
@VictorSvetogor commented on GitHub (Nov 22, 2015):
@Pro
I found that this happens if I send a message with an attachment that has non- latin name of the file.
@Pro commented on GitHub (Nov 22, 2015):
I'll try to reproduce this problem on my test server so I can find the part of the code which is causing the problem. This will take some days until I have time. If someone else has time to narrow the problem down I'm happy for any help 👍
@stevemayster commented on GitHub (Nov 22, 2015):
@Pro I have same problem too,but my file doesn't have non-latin name of the file.
I think it's happen because my anti-spam filter system wich act as relay server broke signature,but i don't sure because it's happen not with all messages with attachment. How can i help you?
@MikeLabatt commented on GitHub (Nov 25, 2015):
I have a similar "body hash did not verify" issue (tested with Gmail inbox) when sending messages with subject only, no message body. Resending the same message with body, the signature works fine. This is DKIM Signer 2.1.8 on edge Exchange 2007 server going straight to the internet.
Agents are:
Identity Enabled Priority
Connection Filtering Agent True 1
Address Rewriting Inbound Agent True 2
Edge Rule Agent True 3
Content Filter Agent True 4
Sender Id Agent True 5
Sender Filter Agent True 6
Recipient Filter Agent True 7
Protocol Analysis Agent True 8
Attachment Filtering Agent True 9
Address Rewriting Outbound Agent True 10
Exchange DkimSigner True 11
Tried different priorities, like 3 vs. 11, with same result: with body it signs OK, without body it fails.
dkim-signature: v=1; a=rsa-sha256; s=mail; d=example.com; c=relaxed/relaxed; q=dns/txt; h=Date:From:Message-ID:Subject:To; bh=frcCV1k9oG9oKj3dpUqdJg1PxRT2RSN/XKdLCPjaYaY=; b=FDo7CfwA4jj1mQtEb7bR9K+kAvnnD4BTnff5iiIFxEg5ox9ofRNINoO25yAqdFsNu6euUKC5RqyPjAqJhfQcFNGAxG7qDG7TQvvtbabTDv7ayTVOxpjM4eqYEraODKvlre+Cn06aBEL3JcN2ZhEhl9rgczo+PN84WpY6jQA51dA=;
Also, what looks like a minor bugglet: when the configuration tool opens, it does not re-select the radio button associated to RsaSha256.
@AlexLaroche commented on GitHub (Nov 25, 2015):
What canonicalization to do you use?
What are the value of field in your message?
content-Type and content-transfer-encoding
@MikeLabatt commented on GitHub (Nov 26, 2015):
Canonicalization of header/body: relaxed/relaxed
Key size: 1024
Hash: SHA-256
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
If the body is empty, Gmail headers indicate "body hash did not verify".
If the body contains text, GMail indicates dkim=pass. Content-Type and Content-Transfer-Encoding are the same.
The above two variations were also retried with an empty subject, with the same result (empty message failed body hash, empty subject with body passed).
Yahoo mail gives the same results: email without body gives "dkim=permerror (bad sig)", while email with body results in "dkim=pass (ok)".
@Pro commented on GitHub (Nov 26, 2015):
@MikeLabatt the small bug with the radio button is now fixed, see:
github.com/Pro/dkim-exchange@6cd52a755d(thanks @AlexLaroche)Regarding the other problem of invalid signature: I'll try to find some time in the weekend to debug the problem.
@VictorSvetogor commented on GitHub (Nov 27, 2015):
@Pro ,
i've sent the email to you.
@MikeLabatt commented on GitHub (Nov 27, 2015):
@Pro: sent you two emails around 20:03 UTC (one with body, one without body, as per issue)
@MikeLabatt commented on GitHub (Nov 28, 2015):
@Pro: Just sent you another mail, concerning a similar body hash failure, but this time with emails that have an attachment (and a message body).
@Pro commented on GitHub (Nov 29, 2015):
@MikeLabatt, @VictorSvetogor I looked at your emails and also tried to reproduce the error, but with no success. Can you please send first a mail where the DKIM signature should be OK to the E-Mail address indicated below. And then each mail which failed signing separately to this e-mail address:
check-auth-git=s.profanter.me@verifier.port25.comUsing this E-mail address I get the full content of the mail and all the required info (see https://www.port25.com/support/authentication-center/email-verification/ for more info).
@MikeLabatt commented on GitHub (Dec 2, 2015):
@Pro: done (all three emails resent in the same order).
@avoidik commented on GitHub (Dec 11, 2015):
Same problem with Exchange 2010 UR11 no matter of canonicalization algorithms. Body contains cyrillic symbols without attachments. If i remove my email signature dkim passed. Is this encoding problem?
Test email
Result from port25 with specified signature
Result from port25 without specified signature
If we check email inside google email, the difference in one line.
Content-Transfer-Encoding: 7bit <- passed
Content-Transfer-Encoding: 8bit <- not passed
@avoidik commented on GitHub (Dec 11, 2015):
And the answer is this:
http://stbuehler.de/blog/article/2011/05/19/dkim_fails_at_content-transfer-encoding.html
@Pro commented on GitHub (Dec 11, 2015):
@avoidik Thanks for your further analysis. It seems that the problem is related to #86
I'll try to debug the problem next sunday and hopefully come up with a solution
@Pro commented on GitHub (Dec 14, 2015):
I've found MimeKit (https://github.com/jstedfast/MimeKit) which also provides a better implementation for DKIM signing. We will integrate it into this agent and release it as version 3.0.0 (see https://github.com/Pro/dkim-exchange/tree/mime_kit). This will probably reduce the number of problems regarding wrongly signed mails. It will take some days, hopefully it is ready in January.
@Pro commented on GitHub (Jan 1, 2016):
v3.0.0 beta is now released. This should fix the 8bit issue:
https://github.com/Pro/dkim-exchange/releases/tag/v3.0.0-beta
@VictorSvetogor commented on GitHub (Feb 22, 2016):
i've installed 3.0.1, but it didn't help
@Pro commented on GitHub (Feb 22, 2016):
Ok, then maybe this is fixed in the new Mime Kit version 1.2.21 (https://github.com/jstedfast/MimeKit/blob/master/ReleaseNotes.md)
It mentiones 'Fixed MimeMessage.DkimSign() to not enforce 7bit encoding of the body. (issue #224)'
This version will be included in the next dkim signer release.
@Pro commented on GitHub (Feb 27, 2016):
Please check the new version:
https://github.com/Pro/dkim-exchange/releases/tag/v3.0.2.
If there's still an issue with 8-bit signing, please open an issue on the MimeKit repo: https://github.com/jstedfast/MimeKit/issues and link it here.
@wish01 commented on GitHub (Feb 17, 2017):
Hello, I installed version 3.0.8 and mimekit 1.2.21. Error signed letters with the name in Russian investments, dkim Error signature continues. Message gmail: DKIM: NEUTRAL, domain null
@avoidik commented on GitHub (Feb 17, 2017):
Did you configured SPF/TXT records for your MX-domain?
17 февр. 2017 г. 5:55 пользователь "wish01" notifications@github.com
написал:
@wish01 commented on GitHub (Feb 17, 2017):
If the name of the attachment in a letter in English, the DKIM record is correct. One and the same attachment with different names in Russian not being tested on English test passes.
Content-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet; name= "Сервера добавленные в МОМ за последние 2 месяца Qwe.xlsx"
Content-Description: "Сервера добавленные в МОМ за последние 2 меся""ца Qwe.xlsx"
Content-Disposition: attachment; filename= "Сервера добавленные в МОМ за последние 2 месяца Qwe.xlsx"; size=9302; creation-date="Fri, 17 Feb 2017 09:11:32 GMT"; modification-date="Tue, 17 Jul 2012 06:32:13 GMT"
Content-Transfer-Encoding: base64