3

The scenario:

I have a couple email servers running on Debian behind a firewall, a public IP and I have properly setup my DNS records (MCX, DMARC, DKIM, SPF).

This is an example of my DNS records (output by dig command):

DKIM
customselector._domainkey.domain.com. 3600 IN TXT  "v=DKIM1\; h=rsa-sha256\; k=rsa\; s=email\; " "p=MII...

SPF:
domain.com.           3599    IN      TXT     "v=spf1 mx -all"

MX:
domain.com.           3599    IN      MX      1 mailsystem.domain.com.

DMARC:
_dmarc.domain.com.    3599    IN      TXT     "v=DMARC1\;p=quarantine\;sp=reject\;rua=mailto:dmarc@domain.com\; ruf=mailto:dmarc@domain.com\; fo=1\; adkim=r\; aspf=r\; pct=100\; rf=afrf\; ri=86400"

Trying several public testing systems my whole setup gets validated 100% ok. But then I start to get these weird reports showing a lot of bad emails comming out of my public IP as well as some emails getting perfectly validated by the same domain. The next fragment comes from a Google report:

<record>
    <row>
      <source_ip>0.0.0.0</source_ip>
      <count>6</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>pass</dkim>
        <spf>pass</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>domain.com</header_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>domain.com</domain>
        <result>pass</result>
        <selector>customselector</selector>
      </dkim>
      <spf>
        <domain>domain.com</domain>
        <result>pass</result>
      </spf>
    </auth_results>
  </record>
  <record>
    <row>
      <source_ip>0.0.0.0</source_ip>
      <count>16</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>fail</dkim>
        <spf>pass</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>domain.com</header_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>domain.com</domain>
        <result>fail</result>
        <selector>customselector</selector>
      </dkim>
      <spf>
        <domain>domain.com</domain>
        <result>pass</result>
      </spf>
    </auth_results>
  </record>
  <record>

I got 6 good mails VS 16 bad mails, all of them practically with the same content.

The tests:

  • check-auth@verifier.port25.com -> ok
  • Gmail Headers -> dkim=pass header.i=@domain.com;
  • www.mail-tester.com -> DKIM_VALID
  • autorespond+dkim@dk.elandsys.com -> DKIM Signature validation: pass
  • dig on several DNS servers -> ok
  • mxtoolbox.com -> everything looks ok
  • Mail headers on diffrent domains -> ok

The configuration:

I'm using opendkim, this is what I consider relevant:

Canonicalization    relaxed/relaxed
Mode            sv
SubDomains      yes
3

While my DKIM record is "valid", some validators won't accept h=rsa-sha256; argument in a DNS record and will render the DKIM signature as invalid. I imagine that Google is using a few diffrent linux distros in their mail servers with diffrent validators.

To solve this issue just remove that argument on your DKIM record it should look like this:

v=DKIM1; k=rsa; s=email; p=MI...

After this every single email will get properly validated.

I crossed across http://dkimvalidator.com while doing some research and it was the only tool that yield a rather confusing message:

result = invalid
Details: public key: does not support hash algorithm 'sha256'

Surprisingly this error seems to be unusual but when you use opendkim to generate your keys you might find yourself doing something like this:

opendkim-genkey -b 2048 -h rsa-sha256 -r -s customselector -d domain.com -v

Which writes the incorrect argument into the txt output file resulting in a invalid DKIM record.

  • 1
    If you want to specify the hash in the DKIM key record, you could use h=sha256;. The key type could be described in a different tag, with k=rsa (default value). Note that h=rsa-sha256; should in Therory also be accepted by all Verifiers, as it is syntactically correct, and the RFC explicitly states that unknown values should be ignored. See tools.ietf.org/html/rfc6376#page-27 for details. – user228011 Jan 24 '18 at 21:10
  • 1
    Thanks, noted. opendkim-genkey outputs h=rsa-sha256 which I think I should report as a bug. Will look into it later. – Solrac Jan 24 '18 at 21:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.