I have a domain that sends two different types of emails: ones that are created via automated processes like notifications that go out to users, and ones that are generated from Request Tracker (the ticket system).
We set up DKIM awhile back and I made the mistake of never verifying that both types of emails were working, so I never checked the RT emails. More recently we realized that occasionally RT-generated messages are hitting spam filters, and it feels like failed DKIM checks may have a hand in it.
RT adds some headers to each message, for example:
X-RT-Loop-Prevention: Support RT-Ticket: Support #3165 Managed-by: RT 3.8.2 (http://www.bestpractical.com/rt/) RT-Originator: email@example.com X-RT-Original-Encoding: utf-8
However, those headers do not appear in the DKIM signature. For example, here is a hardfail string from Gmail this morning:
Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of firstname.lastname@example.org designates xxx.xxx.xxx.xxx as permitted sender) email@example.com; dkim=hardfail firstname.lastname@example.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xxx.com; s=mta; h=Date:Content-Type:Content-Transfer-Encoding:MIME-Version:To:Message-ID:References:In-Reply-To:Reply-To:From:Subject; bh=GDIpYEyFTXB3RPUtFDKxW+iBpkOYngdUELnMw316Ohk=; b=A6iZYrFUZ68gszu/KeTyMoUUE0jbGlZ+yxcz72gq7Bdxe+jAkcgFoExN+duxLPIZqJm87Gz+XCB9IwnQbKC5lsVKK8cwUzQTHZx6E8ZPyynkv0NvC8MStDgOswFnjdcy;
As you can see, the RT headers are not included in the DKIM signature. When a mail is sent from the site outside of RT, Gmail validates the signature properly.
My understanding was that "custom" headers (X-xxxxxxxx) are ignored by DKIM but others are not, for example the RT-Ticket, Managed-by, and RT-Originator above.
Does anybody have any detailed experience with this or know where I might look to get DKIM to include those headers in the signature? I have searched through the RT support a bit and cannot find much. I am using exim as the MTA, and the system is Debian Lenny.
edit: I may be barking up the wrong tree here with the header fields, I am not sure. I modified the exim configuration to explicitly tell it which headers to look at, by taking the list of headers from RFC4871 (http://tools.ietf.org/html/rfc4871) and adding the extra headers that RT is adding, like so:
dkim_sign_headers = From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:Precedence:X-RT-Loop-Prevention:RT-Ticket:Managed-by:RT-Originator:X-RT-Original-Encoding
That resulted in all of the RT headers being properly added to the signature, however, Gmail still reported a hardfail on the signature when it came via RT. As far as I can tell RT is using exim in the same way as any other external program, so I am at a loss to explain why those messages are failing.