DKIM hash mismatch (failure) on sent emails, only when composed as HTML

RainLoop version, browser, OS: 1.14.0 Community on CentOS 6 (connecting to a CentOS 7 mailserver over IMAP). Locally: latest Chrome, Windows 10.

Expected behavior and actual behavior: Email sent in RainLoop should pass with a valid DKIM header when assessed by the receiving server. Actual behaviour: GMail or any other MX (e.g. Postfix) indicates either an unprotected key or a DKIM failure when the email is received and headers are inspected.

Steps to reproduce the problem: Send an email with RainLoop using the HTML composer.

Logs or screenshots:

Email sent via RainLoop which fails DKIM on receipt (certain details redacted):

Received-SPF: pass (google.com: domain of christopher.woods@example.com designates deaf::beef as permitted sender) client-ip=deaf::beef;
MIME-Version: 1.0
Date: Thu, 14 May 2020 21:44:10 +0000
Content-Type: multipart/alternative; boundary="--=_RainLoop_900_870903297.1589492650"
From: Chris Woods <christopher.woods@example.com>
Message-ID: <3b7aba427bd5a00516d900c241181263@example.com>
Subject: DKIM test 4 after resign and new private key
To: example@testdomain.com
Cc: christopher@testdomain.org.uk

----=_RainLoop_900_870903297.1589492650
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Hello World.

----=_RainLoop_900_870903297.1589492650
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html><html><head><meta http-equiv=3D"Content-Type" content=3D"tex=
t/html; charset=3Dutf-8" /></head><body><div data-html-editor-font-wrapper=
=3D"true" style=3D"font-family: arial, sans-serif; font-size: 13px;">Hello =
World.<br><br><signature></signature> </div></body></html>

----=_RainLoop_900_870903297.1589492650--

Email sent via IMAP client (Aquamail Pro on Android) which passes DKIM:

Received-SPF: pass (google.com: domain of christopher.woods@example.com designates 172.19.1.2 as permitted sender) client-ip=172.19.1.2;
From: Chris Woods <christopher.woods@example.com>
To: <example@testdomain.com>
Date: Thu, 14 May 2020 22:47:06 +0100
Message-ID: <1721526d918.27f7.408c82f8974a469642cbb90aed154c75@example.com>
User-Agent: AquaMail/1.24.1-1586-beta (build: 102400007)
Subject: DKIM test from client, not webmail
MIME-Version: 1.0
Content-Type: text/plain; format=flowed; charset="us-ascii"
Content-Transfer-Encoding: 8bit

hi world.

To rule out DKIM, DNSSEC or Postfix, I regenerated all DKIM keys, DNSSEC resigned all records and triple-checked everything had propagated. All servers restarted and checked for correct operation.

It seems, reliably, that when an email is sent using RainLoop composed in HTML mode, something is happening which is making the header hash mismatch. Sent in plaintext, DKIM validates perfectly. Emails sent as plaintext or HTML with other clients always pass DKIM. Perhaps it's how RL is encoding HTML special chars?

Happy to do more testing and provide unredacted logs privately.

@ChristopherW I've tried to verify with my Rainloop 14.0 et my mail servers the issue that you described. When I send emails with Rainloop, my mail server always add DKIM signature with html or non formatted text. An example, with an email sent to gmail address.

You can see: dkim=pass header.i=@test.domain.fr

Delivered-To: user@gmail.com
Received: by 2002:a50:450:0:0:0:0:0 with SMTP id 16csp1533072ecr;
        Thu, 4 Jun 2020 06:59:24 -0700 (PDT)
X-Google-Smtp-Source: ABdhPJznV04zMySnsO/s2pfgDXz9rFr7j72fKhsIIgvJE/oAfKN8nj93S/C10rbfMS5J3TdprdUq
X-Received: by 2002:a5d:468d:: with SMTP id u13mr4933188wrq.73.1591279164552;
        Thu, 04 Jun 2020 06:59:24 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1591279164; cv=none;
        d=google.com; s=arc-20160816;
        b=Jgb6USVHykNBsH8u9xEbzAZb+7PKm00f9euLNCdJjHsNxZ20Yg96neA1AU6+i2rjPx
         jFL2HMhtqR1ShFLL48T1MBkUrvfD6qZBoYrTgTj6P4z4VkUtCFXIxQgNETAvHeyuXR8W
         i4Epgm38mJx6rL8t+lT5GYm+atkHqIipVUvNGu6XKhHA3A+NQtBlA7iVeQXLKfU3lNLU
         gr3NvniyZMM9Qv1ro4FN9THayTvMio4htRFkrm5nYCZaUJc5v44v0Im+XqwrUSTp2uKW
         SWXoOzAZnnHI0QaQk+fvgWapE2+do0ooTUjAoVEBu+m0yv4BG+U/VOcHeX6YPlRSwfAh
         Xz0A==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=to:subject:message-id:from:date:mime-version:dkim-signature;
        bh=FJbfrtv+cxhW55iMi9reQkkVGvIcTprMdhm5f/b5NjE=;
        b=EZb63hXCf1lZcB3Hsl/zwBBlWBMr2amsiy6y32gN125yhNsKSz2T012on9QXwgaBMA
         U/KPBmg1a+jMZE2EKULWtXiWseve1+747BrQkWmp5CXVrnH5fnIVvckR94wNWqWuYknu
         v25JA+zu0QMmzVCf+ezfJyErxoxtfjSo71YCDH2sMqG2vxZDv9vOqHkD6IwhIv25wmDy
         QDcOFZJCutUWHn84OGM+Wx+R0Df1VbhEIXgObTYFw2ly7E1yrTvKhP81xGeOYwG6ZraR
         /6GieyFDmFaNs9FdGhc3Jutqh5z8j/v+lKmc+fhRHTUsiG2CUAXxzs1tHHQbW9Nxmy2e
         VU3A==
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass header.i=@test.domain.fr header.s=mail header.b=NF56conH;
       spf=pass (google.com: domain of sender@test.domain.fr designates 162.38.xxx.xxx as permitted sender) smtp.mailfrom=sender@testdomain.fr
...
Received-SPF: pass (google.com: domain of sender@test.domain.fr designates YYY as permitted sender) client-ip=XXX;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@test.domain.fr header.s=mail header.b=NF56conH;
       spf=pass (google.com: domain of sender@test.domain.fr designates YYY as permitted sender) smtp.mailfrom=sender@test.domain.fr
....
Received: from localhost (localhost [127.0.0.1])
    by ZZZ (Postfix) with ESMTP id 2B7D6827AF
    for <user@gmail.com>; Thu,  4 Jun 2020 15:59:24 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=
    test.domain.fr; h=subject:subject:message-id:from:from
    :x-mailer:content-type:content-type:date:date:mime-version
    :received:received; s=mail; t=1591279164; x=1593093565; bh=FJbfr
    tv+cxhW55iMi9reQkkVGvIcTprMdhm5f/b5NjE=; b=NF56conH//cSuNqwOJ2Qx
    AAIx0m6CtzVazzancbMjkp8clKsszxkbB67zS4t6szVjb2igT1BWrdjVhgJYjnU7
    SDEGthAZ7HEMJTz4giBNyoTFjACkX9PY8MRtTtLQoxiVda4ENdqOUw7a73EW2KnK
    AiH1a3T4jSQFVIlWBFIQxo=
...
Received: from ZZZ ([127.0.0.1])
    by localhost (ZZZ [127.0.0.1]) (amavisd-new, port 10024)
    with LMTP id bDCr7ASXtA3F for <user@gmail.com>;
    Thu,  4 Jun 2020 15:59:24 +0200 (CEST)
Received: from webmail.test.domain.fr (localhost [127.0.0.1])
    by ... (Postfix) with ESMTPSA id 002858278D
    for <user@gmail.com>; Thu,  4 Jun 2020 15:59:23 +0200 (CEST)
MIME-Version: 1.0
Date: Thu, 04 Jun 2020 13:59:23 +0000
Content-Type: multipart/alternative;
 boundary="--=_RainLoop_470_752577190.1591279163"
X-Mailer: RainLoop/1.14.0
From: sender@test.domain.fr
Message-ID: <18595cd57ad2e84a01ed8edf30eb02ea@test.domain.fr>
Subject: Rainloop HTMl DKIM
To: "user" <user@gmail.com>
X-Virus-Status: Clean

----=_RainLoop_470_752577190.1591279163
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Hello Word

----=_RainLoop_470_752577190.1591279163
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html><html><head><meta http-equiv=3D"Content-Type" content=3D"t=
ext/html; charset=3Dutf-8" /></head><body><div data-html-editor-font-wrap=
per=3D"true" style=3D"font-family: arial, sans-serif; font-size: 13px;"> =
<strong>Hello Word </strong><br><br><br><br><br><br><signature></signatur=
e> </div></body></html>

----=_RainLoop_470_752577190.1591279163--

I use Postfix + Amavisd-new (DKIM). So I suppose Rainloop sends correctly HTML messages.

RainLoop / rainloop-webmail

DKIM hash mismatch (failure) on sent emails, only when composed as HTML #2004