problem with dkim - google / gmail.com

[RedJohn14]

Hello,

I have installed postsrsd with config like this:

recipient_canonical_maps=tcp:localhost:10002 sender_canonical_maps=tcp:127.0.0.1:10001 sender_canonical_classes = envelope_sender recipient_canonical_classes= envelope_recipient,header_recipient

If i send some email to a emailaddress to my server and forward this email to gmail.com, email received at gmail.com (SPF check is fine). But DKIM faild but why?

For the SRS Domain I have disabled DKIM because my server have no key for the subdomain.

Attached you find the original e-mail header from the google side. But why is there a dkim error? Anybody have an idea how I can fix the dkim error? Because, yes with postsrsd the address is correct rewrited but if I have DKIM erros this is not so nice like before with SPF errors.

`Delivered-To: [email protected]
Received: by 2002:a67:2943:0:0:0:0:0 with SMTP id p64csp2380180vsp;
Thu, 9 Apr 2020 14:18:21 -0700 (PDT)
X-Google-Smtp-Source: APiQypICbdvesVox4dnh67/N7xFT5o3h7/riKl+sAlOoPQ+d5yPzmIpioB29mG/SbjekgWRwip6M
X-Received: by 2002:a1c:a9d3:: with SMTP id s202mr1764033wme.160.1586467101554;
Thu, 09 Apr 2020 14:18:21 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1586467101; cv=none;
d=google.com; s=arc-20160816;
b=XDJ8LIqRgxrwq431fz6aE9AH6WnQDKbK8fMfRw/Wo8yataWVWReBnuI8EjRywmo8o0
dkb1uaTxN/MTC619i/JpaNTXfvC7gTzGtC0vuMTUd6orGnsuZJ3PHkNeWiAyvRrpCvC2
EaRDjocNE8QlgGNQmobzyss1LDeTCoxxE7k98/boECcdGYk9b5xVJ6aut6HhkcviwMfb
Isfjy8pJUWX2wIHAjlWmV/F9tPZWIXwxmye1UyeYsMQ+NTq3c7cWug+ivEIEo1xroxNw
0knCJY3g8RNztAomH6uwBkFuQ69elWg8WBp+GO0nXI+xd+WCQKLAG0IdTpGmXJETCCBK
m/Rw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=message-id:mime-version:content-language:accept-language:date
:thread-index:thread-topic:subject:to:from:dkim-signature;
bh=gmIvQN0R6NtPAucNIBV7N7FkS45SPTihQkmtnQo1KeM=;
b=GBh775AZm0g4NN5eP5g5HVvixw0kqz5nBzbHWLOKCbcoZeJoVk0mtyaErlncE7Hl4Q
xbPCtHvqAG1lEEIC1g2lXkzOxFGZCEWISl8YFk/rV9zpZMFn5j0IeJfnWRGRASpjULRY
ydm+uv44IRl6ZNInfCpDpD+VrN7j3NhyxEtsx6cc6luSdTfaQnak0VH7aYMXbGNI5UiX
v4j3DuRxCdbKLzZ+ZuGwxBiiyuY1AwQiBMSr7ZuQHNJ0zq+JtqudOb7W8NG77Ztv/KO8
feC4XE2sCemWE62fdKMDRkQTyXjDHli653NFcC7yOcOrrcNBLdAcXxc9PcxzYN7zCRNm
696g==

ARC-Authentication-Results: i=1; mx.google.com;
dkim=fail [email protected] header.s=DKIM header.b=Kv5rfJX3;
spf=pass (google.com: best guess record for domain of srs0=2ABq=K3=sender.domain=[email protected] designates 5.5.5.5 as permitted sender) smtp.mailfrom="SRS0=2ABq=K3=sender.domain=[email protected]"
Return-Path: <SRS0=2ABq=K3=sender.domain=[email protected]..de>
Received: from my.mailserver (my.mailserver. [5.5.5.5])
by mx.google.com with ESMTPS id g24si128574wmh.189.2020.04.09.14.18.21
for [email protected]
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Thu, 09 Apr 2020 14:18:21 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of srs0=2ABq=K3=sender.domain=[email protected] designates 5.5.5.5 as permitted sender) client-ip=5.5.5.5;
Authentication-Results: mx.google.com;
dkim=fail [email protected] header.s=DKIM header.b=Kv5rfJX3;
spf=pass (google.com: best guess record for domain of srs0=2ABq=K3=sender.domain=sendersrs.domain.de designates 5.5.5.5 as permitted sender) smtp.mailfrom="SRS0=2ABq=K3=sender.domain=[email protected]..de"

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sender.domain; s=DKIM; h=MIME-Version:Content-Type:Message-ID:Date:Subject:To:From; bh=gmIvQN0R6NtPAucNIBV7N7FkS45SPTihQkmtnQo1KeM=; b=Kv5rfJX3jJCq3PmYhfh/Hg0a1XWjRns4f4NN/BHeYpiaC8ut0L+jJ3E3oMm2ihqMPvnfRwSwk+8FOgxHW4jkU940+6O6hIxc865u4880u5xDextWLZHdXfZ3Usj+HM8605yLlb1FmKm8W8aS8ojygOclR4rmPZZGyyVBd7LcMSo=;
From: "Test User" [email protected]
To: "[email protected]" [email protected]`

[roehling]

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sender.domain; s=DKIM; h=MIME-Version:Content-Type:Message-ID:Date:Subject:To:From; bh=gmIvQN0R6NtPAucNIBV7N7FkS45SPTihQkmtnQo1KeM=; b=Kv5rfJX3jJCq3PmYhfh/Hg0a1XWjRns4f4NN/BHeYpiaC8ut0L+jJ3E3oMm2ihqMPvnfRwSwk+8FOgxHW4jkU940+6O6hIxc865u4880u5xDextWLZHdXfZ3Usj+HM8605yLlb1FmKm8W8aS8ojygOclR4rmPZZGyyVBd7LcMSo=;

This looks like a DKIM signature to me, so I doubt that you properly disabled signing.

[RedJohn14]

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sender.domain; s=DKIM; h=MIME-Version:Content-Type:Message-ID:Date:Subject:To:From; bh=gmIvQN0R6NtPAucNIBV7N7FkS45SPTihQkmtnQo1KeM=; b=Kv5rfJX3jJCq3PmYhfh/Hg0a1XWjRns4f4NN/BHeYpiaC8ut0L+jJ3E3oMm2ihqMPvnfRwSwk+8FOgxHW4jkU940+6O6hIxc865u4880u5xDextWLZHdXfZ3Usj+HM8605yLlb1FmKm8W8aS8ojygOclR4rmPZZGyyVBd7LcMSo=;

This looks like a DKIM signature to me, so I doubt that you properly disabled signing.

Hello, thanks for so fast reply. The DKIM Signature you see is the Signature from the original sender not the signature from my server with postsrsd.

Any idea why DKIM is broken? Does postsrsd change any important thing?

I tested with orher forwarders like 1and1. And set some forward Emailadresse there. If 1and1 forward emails with srs DKIM Header is valid.

So postsrsd make anything any idea?

[RedJohn14]

Okay here some information about my mail systems:

1. I have a SPAM Gateway based on Proxmox Mailgateway, the System check if E-Mail is okay and relay it to backend SMTP Server
2. Backend SMTP Server (Postfix) check if Mailbox or forward is available and use for external forward postsrsd. If foward available the system send out the email with SRS. Otherwise it will delivered to local mailbox if there is any mailbox.
3. Backend SMTP Server have DKIM Signature opendkim installed BUT outgoing postsrsd emails have not DKIM signature. I have also change postsrsd domain to some subdomain, to exclude that the domain is the problem.

So if I create forward from myemaildomain.com to gmail.com mailbox (external) and send from another domain (sender.domain) which have DKIM signatur. My backend Postfix Server used postsrsd correctly and send email to gmail.com BUT at the gmail.com side I have some DKIM Signature failed, the SPF check is O.K.

Any idea what makes the DKIM signatur error? does any tool change something that DKIM is not valid? Any idea what the mistake is?

[roehling]

Hello, thanks for so fast reply. The DKIM Signature you see is the Signature from the original sender not the signature from my server with postsrsd.

Ah, I see.

Any idea what makes the DKIM signatur error?

I can't really do any remote diagnostics, but common causes for DKIM failures include:

• Modifying the MIME boundaries by the forwarding entity.
• Anti-virus or anti-spam programs modifying the body of the message.
• Modifying protected headers in any way (adding, removing, reordering, changing). In your case, those would be MIME-Version, Content-Type, Message-ID, Date, Subject. To, From (see the h= entry in the DKIM-Signature).
• Re-encoding the message.

[RedJohn14]

Hello,

Thanks again for fast reply. Any possibility that you can help me? I see you are from germany. Any possibility that i can send you the org. Header via PN per E-Mail?

Regards and many thanks !

[antoinerousseau]

So, is there a way to sign forwarded emails with DKIM when using postsrsd?
I set up DKIM signing in Postfix and it stopped working when I installed postsrsd

[dr0bz]

Hi @roehling ,

thanks for pointing!

Modifying protected headers in any way (adding, removing, reordering, changing). In your case, those would be MIME-Version, Content-Type, Message-ID, Date, Subject. To, From (see the h= entry in the DKIM-Signature).

that was my case. I configured my postfix with mime_header_checks and header_checks to remove Mime-Version
/^Mime-Version:/ IGNORE
It was done long before installing postsrsd for sake of anonymity among removing other headers.
All emails sent from other players and signed with DKIM failed the authentication at gmail and at my server (they all had mime-version signed, among other headers). So it has nothing to do with postsrsd but with wrong postfix config.

@RedJohn14 thats probably your case. DKIM h= contains MIME-Version but it's not in your headers.

Regards and thanks,
dr0bz