Comments on: How to Setup DKIM for Postfix in Fedora using dkim-milter

By: How to install dkim for postfix in centos 5.4 - - Coding Answers

How to install dkim for postfix in centos 5.4 - - Coding Answers — Thu, 09 Dec 2010 03:56:11 +0000

[...] I am trying to install DKIM for my postfix so that i have a signature. I am following this guide: http://allaboutlamp.com/2009/09/setup-dkim-for-postfix-in-fedora-using-dkim-milter/ [...]

By: How to install dkim for postfix in centos 5.4 | DeveloperQuestion.com

How to install dkim for postfix in centos 5.4 | DeveloperQuestion.com — Thu, 09 Dec 2010 00:43:43 +0000

[...] Tags: DKIM, ftp I am trying to install DKIM for my postfix so that i have a signature. I am following this guide: http://allaboutlamp.com/2009/09/setup-dkim-for-postfix-in-fedora-using-dkim-milter/ [...]

By: Jim

Jim — Wed, 16 Jun 2010 19:46:47 +0000

After extensive test, I found out the magic number of 990 for my php mail() stop working on dkim error “dkim=neutral (body hash did not verify)”

It turns out to be the configure of postfix limit of 990 and automatically add some line break after the 990th character, which caused the dkim fail.

lmtp_line_length_limit (default: 990)

The LMTP-specific version of the smtp_line_length_limit configuration parameter. See there for details.

This feature is available in Postfix 2.3 and later.

By: Amy

Amy — Fri, 04 Jun 2010 16:36:48 +0000

Trailing blank lines seems to do it too. Looks like we have to be careful about filtering our mail before submitting it to PHP’s mail() function. I expect there to be other things that trip it up.

I think I’ll abstract it out with a library.

By: skyhorse

skyhorse — Fri, 04 Jun 2010 03:37:46 +0000

Henry Hughes is right, I have tried with openssl many times but getting hardfail with google.
After changing to dkim-genkey, I got passed.

Thank you alot for this post.

By: Emily

Emily — Tue, 01 Jun 2010 09:06:15 +0000

Trailing blank lines seems to do it too. Looks like we have to be careful about filtering our mail before submitting it to PHP’s mail() function. I expect there to be other things that trip it up.

I think I’ll abstract it out with a library.

By: Daniel Lam

Daniel Lam — Sat, 15 May 2010 02:59:22 +0000

Thanks for the information! Appreciate it!

By: ThomasRutter

ThomasRutter — Thu, 06 May 2010 14:24:29 +0000

Trailing blank lines seems to do it too. Looks like we have to be careful about filtering our mail before submitting it to PHP’s mail() function. I expect there to be other things that trip it up.

I think I’ll abstract it out with a library.

By: ThomasRutter

ThomasRutter — Thu, 06 May 2010 14:14:59 +0000

The “did not verify” problem when using PHP seems to be caused by email bodies containing the “\r” character. That is, a carraige return. Postfix’s sendmail implementation expects line breaks to be “\n” only.

Stripping these out before using mail() fixed the problem for me, and all emails verify DKIM properly with PHP posting to sendmail->postfix->dkim-filter

I’ve seen problems before with PHP sending mail with “\r\n” instead of “\n”. It’s strange, because email itself wants “\r\n”, however PHP (or sendmail) seems to expect “\n” only. Not sure how this affects things if you’ve configured PHP not to use sendmail.

My guess is that PHP or sendmail is converting line breaks before dkim-filter, and dkim-filter sees a version with incorrect “\r\r\n” line breaks, then these are stripped out when the mail is transmitted, breaking DKIM’s signature. Unfortunately dkim-filter’s “relaxed” body verification doesn’t mitigate this problem as it deals only with whitespace within a line – position and type of line breaks ignored.

By: Daniel Lam

Daniel Lam — Thu, 31 Dec 2009 04:20:24 +0000

Good to know that it helped! Regarding the use of openssl – that was just because I was not aware of the dkim-genkey tool. Thanks for pointing out!