search

lieser / dkim_verifier

DKIM Verifier Extension for Mozilla Thunderbird
MIT License
210 stars 35 forks source link

DKIM Invalid (DKIM version missing) when sent via hosted Exchange service #16

Closed jon-lester closed 10 years ago

jon-lester commented 10 years ago

I'm using DKIM verifier 0.5.0, and our organisation has just set up DKIM with the Amazon SES service for some of our transactional mails.

When testing, the mail verifies ok if it's sent to my Gmail account and then picked up via POP3 into Thunderbird. It also verifies ok if the mail is sent to my ISP-hosted email account and then picked up via POP3.

However when the same email (exactly the same one, adding all addresses to the same 'To' line) is sent via my work email address, which is a hosted exchange service provided by Cobweb, and then also picked up via POP3, it arrives with the error message: "DKIM Invalid (DKIM version missing)".

When comparing a raw text dump of the three sets of email headers, I can see no difference between the contents of the DKIM-Signature header other than whitespace formatting and capitalisation of the header name.

(The actual base-64 content of the Cobweb email is very different to the other two though. Perhaps that's the problem - is this related to Exchange having nuked the format? In which case the error message seems misleading - shouldn't it just be a straight fail?)

lieser commented 10 years ago

This error message should only occur if the "v=" tag in the "DKIM-Signature" header is missing. If besides whitespace there is now difference in the header, its probably a bug in the parsing. For finding the error it would help a lot if I had the "DKIM-Signature" header. Could you please send me the saved message to dkim.verifier.addon@gmail.com, or post or e-mail me the "DKIM-Signature" header? If you only send me the header, please make sure that the whitespace stays the same as in the original message (or replace whitespace that may be lost or altered with for example <tab>). Thanks

lieser commented 10 years ago

Thanks for sending me the mail. The error was that the add-on could handle the "DKIM-Signature" header name only in a case sensitive matter. Should be fixed in 0.5.2 (see c0ed0a47fde12ebf5e7abe58b139b5f4af17146b).

Now the verification fails with "Wrong body hash", but based on what you said and the result of another DKIM verifier, it seems to be the correct result.