Closed pgnd closed 1 year ago
Thanks for the detailed information.
Note that there are two different problems.
The 2. is only visible because a failure to read the ARH is silently ignored.
So why does reading the ARH result from Fastmail falls? My guess is the x-bits=2048
part (I'm currently unable to do any test myself).
Extra information has to be in the format <ptype>.<property>=<pvalue>
.
Note that you should see more details about wait is going on if you enable debugging in the options, see also https://github.com/lieser/dkim_verifier/wiki/Debug#view-error-and-debug-messages.
@lieser
here's the Console output for viewing/opening the 'failed' message, referenced above:
DKIM_Verifier.AuthVerifier ERROR Ignoring error in parsing of ARH Error: Parsing error
match moz-extension://45b48b6c-b201-41df-af61-cc17974bd30d/modules/arhParser.mjs.js:305
parseResInfo moz-extension://45b48b6c-b201-41df-af61-cc17974bd30d/modules/arhParser.mjs.js:188
parse moz-extension://45b48b6c-b201-41df-af61-cc17974bd30d/modules/arhParser.mjs.js:156
getARHResult moz-extension://45b48b6c-b201-41df-af61-cc17974bd30d/modules/authVerifier.mjs.js:241
verify moz-extension://45b48b6c-b201-41df-af61-cc17974bd30d/modules/authVerifier.mjs.js:156
authVerifier.mjs.js:243:8
DKIM_Verifier.AuthVerifier DEBUG ARH result:
Object { version: "3.0", dkim: [], spf: [], dmarc: [] }
authVerifier.mjs.js:320:6
DKIM_Verifier.Verifier DEBUG 2 DKIM-Signatures found. verifier.mjs.js:1467:8
DKIM_Verifier.Verifier DEBUG Verifying DKIM-Signature 2 ... verifier.mjs.js:1482:9
DKIM_Verifier.Verifier DEBUG Parsed DKIM-Signature 2:
Object { original_header: "DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;\r\n d=example.com; i=@example.com; q=dns/txt;\r\n s=dkim-3xxx4-rsa; t=1691500197; h=message-id : date : from\r\n : subject : reply-to : to : content-type : content-transfer-encoding :\r\n from; bh=W...=\r\n", v: "1", a_sig: "rsa", a_hash: "sha256", b: "qzV...==", b_folded: "qzV...==", bh: "W...=", c_header: "relaxed", c_body: "relaxed", d: "example.com", … }
verifier.mjs.js:1484:9
DKIM_Verifier.Verifier DEBUG computed body hash: WX...BI= verifier.mjs.js:1233:7
DKIM_Verifier.Verifier FATAL Error during DKIM verification: Error: An unexpected error occurred verifier.mjs.js:1447:8
DKIM_Verifier.Verifier DEBUG Exception on DKIM-Signature 2 verifier.mjs.js:1490:9
DKIM_Verifier.Verifier DEBUG Verifying DKIM-Signature 1 ... verifier.mjs.js:1482:9
DKIM_Verifier.Verifier DEBUG Parsed DKIM-Signature 1:
Object { original_header: "DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed;\r\n d=example.com; i=@example.com; q=dns/txt;\r\n s=dkim-3xxx4-ed25519; t=1691500197; h=message-id : date :\r\n from : subject : reply-to : to : content-type :\r\n content-transfer-encoding : from;\r\n bh=W...0\r\n CmDvvtbd1dCn3y0BA==\r\n", v: "1", a_sig: "ed25519", a_hash: "sha256", b: "F...=", b_folded: "F...0\r\n C...=", bh: "W...=", c_header: "relaxed", c_body: "relaxed", d: "example.com", … }
verifier.mjs.js:1484:9
DKIM_Verifier.Verifier DEBUG computed body hash: WX...BI= verifier.mjs.js:1233:7
DKIM_Verifier.Verifier FATAL Error during DKIM verification: Error: An unexpected error occurred verifier.mjs.js:1447:8
DKIM_Verifier.Verifier DEBUG Exception on DKIM-Signature 1 verifier.mjs.js:1490:9
DKIM_Verifier.DMARC ERROR Ignored error on getting the DMARC policy Error: An unexpected error occurred dmarc.mjs.js:61:8
DKIM_Verifier.SignRules DEBUG shouldBeSigned:
Object { shouldBeSigned: false, sdid: [], foundRule: false, hideFail: false }
signRules.mjs.js:457:7
DKIM_Verifier.DMARC ERROR Ignored error on getting the DMARC policy Error: An unexpected error occurred dmarc.mjs.js:61:8
DKIM_Verifier.SignRules DEBUG shouldBeSigned:
Object { shouldBeSigned: false, sdid: [], foundRule: false, hideFail: false }
signRules.mjs.js:457:7
DKIM_Verifier.AuthVerifier DEBUG authResult:
Object { version: "2.1", dkim: (2) […], spf: [], dmarc: [] }
authVerifier.mjs.js:198:7
staring at it, i'm not sure what <ptype>.<property>=<pvalue>
specifically to look for
I use fastmail authentication_milter (https://github.com/fastmail/authentication_milter/) on my server to analyze auth & generate AR headers; fastmail uses it on theirs as well.
It conditionally sets the 'x-bits' key --> https://github.com/search?q=repo%3Afastmail%2Fauthentication_milter%20x-bits&type=code
On my end, config sets extra_properties
-> OFF
"DKIM" : {
"hide_none" : 0,
"hide_domainkeys" : 1,
"check_adsp" : 1,
"show_default_adsp" : 0,
"adsp_hide_none" : 0,
!!! "extra_properties" : 0,
"no_strict" : 0
},
i'm not clear if "x-bits" is considered an invalid DKIM tag here, and, as you suggest, causes the parse fail
We (Fastmail) have made changes to remove the problematic tag from our Authentication-Results headers.
@marcbradshaw That is great to hear that you already removed the problematic tag. Did you only change
@pgnd
i'm not clear if "x-bits" is considered an invalid DKIM tag here, and, as you suggest, causes the parse fail
The <ptype>.<property>=<pvalue>
I posted is a reference to the formal definition of the propspec
part the the header, see https://www.rfc-editor.org/rfc/rfc8601#section-2.2.
It is not something you will find in the logs of the addon.
Besides unstructured text in comments (e.g. (2048-bit rsa key sha256)
in your example from mx5.messagingengine.com
), propspec
is the only allowed way to write arbitrary information in the header. But there the "key" part of the key-value pair must contain of two parts separated by a dot.
So x-bits=2048
would have to be written as e.g. x.bits=1024
.
In the log I noticed a lot of Error: An unexpected error occurred
right at the places there a DNS query should happen. This kind of error normally means that something unexpected happens wrong in the internal parts Thunderbird.
Maybe something is going wrong with the loading of the libunbound library?
I can confirm that mail to my fastmail acct no longer lists the 'x-bits=' tag, and DKIM extension correctly reports:
DKIM Valid (Signed by example.com) SPF: pass DMARC: pass
thx! o/
i run
on
in DKIM extension, i've enabled
where,
sending a single test email from my local server to 2 external accounts, @fastmail & @gmail
outbound DKIM sigs are added
@gmail, it's received with DKIM & DMARC pass,
and in TBird, DKIM extension header displays
but @fastmail,
in TBird, DKIM extension header displays