Mail header wrapping breaks DKIM signatures on incoming mail

Hi,

We recently noted that redirected mails from our Courier mail server
were rejected by other mail servers due to DKIM/DMARC errors.
Investigating the issue, I noted it had nothing directly to do with the
redirects, but with the type of DKIM signature and how Courier handles
header wrapping.

The mails in question had DKIM headers with the option
"c=simple/simple". As a background: DKIM supports different signing
modes, simple and relaxed. In simple mode, the signature is created for
the unmodified content. In relaxed mode, there is some
normalization done regarding newlines and whitespaces, so the signature
will "survive" some modifications done by mail servers. The modes can
be set separately for the header and the content, which explains why it
is "simple/simple".

The mails also had some relatively long header lines without line
breaks. It appears Courier applies some header line wrapping. I
replicated this with a subject line like this:
Subject: =?UTF-8?Q?=C3=A4=20This=20is=20a=20very=20long=20Subject=20=C3=A4=20=C3=B6?=

Courier turned this into:
Subject: 
 =?UTF-8?Q?=C3=A4=20This=20is=20a=20very=20long=20Subject=20=C3=A4=20=C3=B6?=

While long header lines are not necessarily recommended, the RFC only
says lines "SHOULD" be shorter than 78 chars, but they are allowed to
be up to 998 chars long (RFC 5322).

While the affected mails do at least two things that I think should be
discouraged (relatively long lines and using "simple" instead of
"relaxed" DKIM mode), they are compliant with the standards. 
This header wrapping breaks the validity of their signatures.

Does Courier have a way to disable any modification or wrapping of
existing headers of incoming mail? I already had previous issues with
Courier modifying MIME structures, but those can all be resolved by
setting "MIME=none" both in the esmtpd and bofh config files (as is
documented on the zdkimfilter web page). However, that does not seem to
address header wrapping.

Generally, I understand that Courier comes from a time where mail
servers were far more commonly modifying mails in all kinds of ways.
However, given DKIM and related DMARC enforcement is becomming more
common and such modifications regularly break signatures, I think
Courier should move to a place where it does not modify mail structures
unless absolutely necessary. Ideally, this should also be the default.

-- 
Hanno Böck
https://hboeck.de/


_______________________________________________
courier-users mailing list
[email protected]
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users