Re: Seemingly eligible mails not getting DKIM signed

On 2026/06/08 5:20 AM, Christian Balzer via Exim-users wrote:
> 2. Mails that don't get signed despite having a valid dkim_domain set.
>     Looking at the mail data there seems to be nothing amiss and rspamd
>     also reports that envelope and header From are identical and has
>     nothing bad to say about header fields.
>     I have "dkim_strict = 0"

> Any ideas what could cause this, i.e. some header encoding (this is Japan
> after all) that Exim is silently failing on and decides not to sign?

The primary controls on a message getting signed are the expansion results
for the dkim_domain, dkim_selector and dkim_private_key options on the
transport being used.

You say that a valid dkim_domain is set; how do you know this (and does
it possibly vary by mesaage)?

> Any means of getting more info without running production servers in debug
> mode?

Debug *is* the "more info'. To sidestep the volume problem of running it
unfettered in a production environment,

a) enable fewer debug channels than "all"
b) use speculatative debug recording (cf. the "kill" option on an
    ACL control=debug)
c) use triggered debug recording (just an ACl control=debug, once an
    "interesting" situation has been detected)

Note that custom ACLs can be called from within a string-expansion,
and that all three of those options above are expanded (as are many
others). Treat your expansions and ACLs as programming languages.

> the handful of user/accounts/addresses where this happens

Just restricting debug to those accounts would be a good start
on the debug output volume problem, I'd think.  A suitably coded
detection of them in the mail-from ACL, and trigger debug there?

-- 
Cheers,
   Jeremy

PS: If anyone wants an example of expansion-calls-ACL to use as
a starter for their own customisation, just ask.

PPS: If anyone feels this is a common-enough issue to warrant specific
facilities, please open an Issue on code.exim.org requesting such.
Mention the Exim "events" mechanism.

-- 
## subscription configuration (requires account):
##   https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
##   [email protected]
## Exim details at https://www.exim.org/
## Please use the Wiki with this list - https://code.exim.org/exim/wiki/wiki