Re: "signature verification failed" (1024-bit key)

From: David Flanigan <dave_at_flanigan.net>
Date: Fri, 07 Aug 2015 08:06:44 -0400

 

Jim,

DKIM header signing on impacts some header fields. In your messages you
will see a line that looks like this:

 h=From:Subject:Date:To:MIME-Version:Content-Type

Only those headers are used in the signature process, all others can be
safely changed/added.

Does MailFoundry edit the message in any way? Add footers, disclaimers,
etc?

Another think you need to make sure of, which testing DKIM, is that you
keep in mind your TTL for the associated DNS records. Sometimes DKIM is
set up fine on the server but still gets remote fails because the keys
have not propagated properly yet.

---
Kind Regards, 
David
David Flanigan
E: dave_at_flanigan.net W: http://www.flanigan.net
On 2015-08-06 19:46, RISP System Administrator wrote: 
> SM - 
> 
> We run all of our outgoing email through MailFoundry spam cleaners, which adds some headers if we've whitelisted an outgoing email address. In our test case, one of the accounts used is whitelisted and the other isn't. The one that went through without the 'signature verification fail' is the one *with* the added headers; the other without the added headers got the 'fail', which is very puzzling. 
> 
> Would it help to post both sets of headers? 
> 
> Jim 
> 
> (btw - new to the list. Do you prefer pre-quote or post-quote replies?) 
> 
> On Thu, August 6, 2015 2:21 pm, SM wrote:
>> Hi Jim,
>> At 01:43 PM 8/6/2015, RISP System Administrator wrote:
>>> However. When testing, we're seeing this header (real domain munged):
>>> DKIM-Filter: OpenDKIM Filter v2.10.3 mail02.domain.com 2832AF78062
>>> Authentication-Results: mail02.domain.com; dkim=fail
>>> reason="signature verification failed" (1024-bit key)
>>> header.d=domain.com header.i=_at_domain.com header.b=CCeF8U5s
>>> 
>>> I haven't been able to find out exactly what the issue is. We
>>> created private keys and public keys using
>>> http://www.dnswatch.info/dkim/create-dns-record, which sets up a 1024-bit key.
>>> 
>>> Where should I look or what should I do to correct this?
>> 
>> The reason means that either the message header and/or the message
>> body was modified after they were DKIM-signed. Are you running any
>> software which might cause that?
>> 
>> Regards,
>> -sm
>> 
>> 
>> 
 

Received on Fri Aug 07 2015 - 12:07:12 PST