Hello,

We've probably found a bug in the mechanism that signs a message (dkim_sign). There's a system (created by Polish CERT) that works as a DKIM validator and it needs to have a message sent from our own mail server.

Link to the system: https://bezpiecznapoczta.cert.pl/check-email/46bb086e96d7a3b043179c508126a85a

We've done some tests with similar systems and only CERT claims that there is a problem with the DKIM signature. At first we thought that the bug was in CERT's mechanisms but later we discovered that when using other DKIM validators (e.g. plugin in Thunderbird) the problem seems to be related to the signature counted by dkim_sign().

Every time when we send a message to CERT (example address: a4bd435380df6f3465f0654c2d78f4a4@bezpiecznapoczta.lab.cert.pl) and BCC or CC to us, even with a simple header record scope:

h=Date:From:To:Subject;

the signature is wrong.

We tried to debug the code with gdb trying to find out what strings are given to sign with the private key, but we failed.

We tested it in the following environment:
mailfromd 8.17.1
mailutils 3.16