validation by yahoo/hotmail/dkimpy fails because of whitespace in h= or header folding issues
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
dkimpy |
Fix Released
|
Medium
|
Stuart Gathman |
Bug Description
Hello. I am new to DKIM, and might be doing something silly.
I build a message using email.mime, call as_string() on it, construct a DKIM object with the msg, and call sign. I prepend that signature onto my message, and send it. An email to a google apps account gives me "dkim=pass. An email to a yahoo account gives "dkim=permerror (bad sig)". This is using the same code, same from email and domain, etc.. I get the same results using pydkim-3 and with the newer dkimpy-5.1.
While I was still using pydkim-3, I tried different things, and managed to get both yahoo and gmail to give me a pass. I changed the sign function to omit the spaces around the colon in the "h=" list, and removed the call to the fold utility in the sign function so that the signature header was all on one long line. With those changes, yahoo and google were both happy.
Any suggestions?
Thanks,
Rob
summary: |
- validation by yahoo fails because of whitespace in h= + validation by yahoo/hotmail fails because of whitespace in h= or header + folding issues |
Changed in dkimpy: | |
status: | Fix Committed → Fix Released |
Hi, Rob, thanks for reporting this.
In <http:// tools.ietf. org/html/ rfc4871# section- 3.5> describing "h=":
Folding whitespace (FWS) MAY be included on either side of the colon separator.
It looks like Yahoo doesn't handle that properly. Perhaps it is worth trying to report an issue to them.
I think a patch to pydkim that makes it not put whitespace in the h= field would be fine. You should add a comment explaining the issue with Yahoo. If there is no FWS I think it won't fold; otherwise we could use strict signing.