adding/enabling 'SignHeaders' in v1.2.2 config causes fail 2 sign, "DKIM: The From header field MUST be signed",

Bug #1901445 reported by pgnd
12
This bug affects 2 people
Affects Status Importance Assigned to Milestone
dkimpy-milter
Fix Released
Medium
Scott Kitterman

Bug Description

i've installed

 pip show dkimpy-milter
  Name: dkimpy-milter
  Version: 1.2.2
  Summary: Domain Keys Identified Mail (DKIM) signing/verifying milter for Postfix/Sendmail.
  Home-page: https://launchpad.net/dkimpy-milter
  Author: Scott Kitterman
  Author-email: <email address hidden>
  License: UNKNOWN
  Location: /usr/local/lib/python3.8/site-packages
  Requires: pymilter, PyNaCl, Py3DNS, dkimpy, authres
  Required-by:

on

 python -V
  Python 3.8.6

 grep _NAME /etc/os-release
  PRETTY_NAME="Fedora 32 (Server Edition)"
  CPE_NAME="cpe:/o:fedoraproject:fedora:32"

as an outbound, signing milter for

 postconf mail_version
  mail_version = 3.5.7

with config,

 dkimpy-milter.conf
  ...
  #SignHeaders
  ...

outbound mail's correctly signed

 Oct 25 14:21:07 mx.example.com dkimpy-milter[36044]: mail from: <email address hidden> ('SIZE=901', 'BODY=8BITMIME')
 Oct 25 14:21:07 mx.example.com dkimpy-milter[36044]: From: test _ <email address hidden>
 Oct 25 14:21:07 mx.example.com dkimpy-milter[36044]: 4CKC9H3znqz2M: rsa-sha256 DKIM signature added (s=dkim-4914619c35e8211e d=example.net)

and verifies/passes at all test sites.

adding _any_ SignHeaders values to config, changing _only_

 dkimpy-milter.conf
  ...
- #SignHeaders
  ...

+ SignHeaders From

or

+ SignHeaders From,Sender,Reply-To,Subject,Date,Message-ID,To,Cc,MIME-Version,Content-Type,Content-Transfer-Encoding,Content-ID,Content-Description

or

+ SignHeaders From,Sender,Reply-To,Subject,Date,Message-ID,To,Cc,MIME-Version,Content-Type,Content-Transfer-Encoding,Content-ID,Content-Description,From

outbound mail -- (re)sending the same mail -- logs,

 Oct 25 14:59:32 mx.example.com dkimpy-milter[37766]: mail from: <email address hidden> ('SIZE=901', 'BODY=8BITMIME')
 Oct 25 14:59:32 mx.example.com dkimpy-milter[37766]: From: test _ <email address hidden>
 Oct 25 14:59:32 mx.example.com dkimpy-milter[37766]: DKIM: The From header field MUST be signed

and the mail's sent unsigned.

Revision history for this message
Birgit Edel (biredel) wrote :

Workaround: Place to-be-signed header names - one per line, oversigned headers occurring twice - in a separate file.

SignHeaders file:/etc/dkimpy-milter/headers

The config parser does not read comma separated lists as expected for OpenDKIM compatibility, but the file option works.

Revision history for this message
Scott Kitterman (kitterman) wrote :

Thanks. The comma separated list should work.

Changed in dkimpy-milter:
importance: Undecided → Medium
milestone: none → 1.2.3
status: New → Triaged
Changed in dkimpy-milter:
status: Triaged → Fix Committed
assignee: nobody → Scott Kitterman (kitterman)
Changed in dkimpy-milter:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.