DKIM signature validation fails with the simple canonicalization

[nlewo]

I'm using SNM 1dd394e63fa15d200faf83988f8fb5f9a54c04c5 with nixos 17.09. The DKIM signature validation is failing on several mail testers. But with a relaxed canonicalization, DKIM signature are valid:

diff --git a/mail-server/rmilter.nix b/mail-server/rmilter.nix
index 2372318..af906c2 100644
--- a/mail-server/rmilter.nix
+++ b/mail-server/rmilter.nix
@@ -39,6 +39,8 @@ let
                 selector = "${cfg.dkimSelector}";
               };
               sign_alg = sha256;
+              header_canon = relaxed;
+              body_canon = relaxed;
               auth_only = yes;
             }
          ''

I don't know why it is failing with the simple canonicalization, so I don't know how to fix it :/ Any idea why I'm getting this problem?

Otherwise, do you think we could add an option to be able to choose between simple and relaxed canonicalization. Or maybe, could we used the relaxed canonicalization by default?

[r-raymond]

Hi niewo, thanks for using SNM!

I don't mind simply patching this to relaxed if there are no objections. Btw, do you need relaxed for both the body and the header? If I had to guess I'd think header should be enough. What is your setup and to which mail testers are you writing?

[nlewo]

• I confirm that relaxed canonicalization is only required on the header.
• I'm using the mail tester http://www.appmaildev.com.

• My configuration is

  
  mailserver = {
  debug = true;
  enable = true;
  fqdn = "abes.fr";
  domains = [ "abes.fr" ];
  
  # DNS configuration is failing
  # See https://github.com/r-raymond/nixos-mailserver/issues/108
  localDnsResolver = false;
  
  # To generate the password mkpasswd -m sha-512
  loginAccounts = {
      "lewo@abes.fr" = {
          hashedPassword = "$6$gjsfhDV5z$Ej.seJ0RbIvJgyy14q11xpYNvxISI.QQf43s26ewblLHD3Kcx5Ws3ykzJjyCTQyVqQodPPaaFvamapLuf/";
          aliases = [
              "antoi@abes.fr"
          ];
      };
  };
  # Enable IMAP and POP3
  enableImap = true;
  enableImapSsl = true;
  
  # Enable the ManageSieve protocol
  enableManageSieve = true;
  };

[tokudan]

@nlewo You might want to replace your email addresses and password with placeholders in this issue. That configuration contains everything needed to try to log into your account, apart from the password. And since you provided the hash, it's actually possible to try to crack the hash locally at a couple of million attempts per seconds.

[nlewo]

@tokudan Thanks, but the hash is not the good one:/