Re: Mail header wrapping breaks DKIM signatures on incoming mail

On Sat 08/Aug/2026 12:46:25 +0200 Sam Varshavchik wrote:
> Hanno Böck writes:
>
>> The mails also had some relatively long header lines without line 
>> breaks. It appears Courier applies some header line wrapping. I 
>> replicated this with a subject line like this:
>> Subject: =?UTF-8?Q?=C3=A4=20This=20is=20a=20very=20long=20Subject=20=C3=A4=20=C3=B6?=
>>
>> Courier turned this into:
>> Subject:
>>  =?UTF-8?Q?=C3=A4=20This=20is=20a=20very=20long=20Subject=20=C3=A4=20=C3=B6?=
>
> I tried this experiment:
>
> $ echo "Subject: mary had a little lamb, its fleece was white as snow. And everywhere Mary went the lamb was sure to go:" | sendmail mrsam
>
> The resulting mail's Subject: header is untouched:
>
> [...]
> Subject: mary had a little lamb, its fleece was white as snow. And everywhere Mary went the lamb was sure to go:
> From: Sam Varshavchik <[email protected]>
> Message-ID: <[email protected]>
> Date: Sat, 08 Aug 2026 06:40:21 -0400
> To: undisclosed-recipients: ;


That's right, wrapping wouldn't occur on local mail.  On previous courier releases there used to be a call to rfc822_getaddrs_wrap(rfca, 70); from rw_rewrite_header_common() in comrwheader.c.  Now that's rewritten in C++.

In zdkimfilter, there's a quirk to sign pre-wrapped versions of To, Reply-To, From, Cc.  It can be disabled as documented under "noaddrrewrite" in
https://www.tana.it/sw/zdkimfilter/zdkimfilter.conf.html

Signing occurs before header rewriting, so the intent here was to sign the header as they will be later modified by Courier.


>> Does Courier have a way to disable any modification or wrapping of 
>> existing headers of incoming mail? I already had previous issues with 
>> Courier modifying MIME structures, but those can all be resolved by 
>> setting "MIME=none" both in the esmtpd and bofh config files (as is 
>> documented on the zdkimfilter web page). However, that does not seem to 
>> address header wrapping.
>
> There's also the NOADDRREWRITE setting in the esmtpd(-ssl) configuration 
> files, but it affects address headers, not other headers.


I have this set, not disabled the above quirk, Courier 1.5.0, and received this (edited) relayed through Gmail:

Authentication-Results: wmail.tana.it;
   spf=pass smtp.mailfrom=gmail.com;
   dkim=pass header.d=tana.it;
   arc=pass header.oldest-pass=0 (2 set(s)) smtp.remote-ip=209.85.128.174
Old-Authentication-Results: mx.google.com;
        dkim=pass [email protected] header.s=delta header.b=AgVh+SlB;
        spf=pass (google.com: domain of [email protected] designates 94.198.96.74 as permitted sender) [email protected];
        dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=tana.it
User-Agent: Mozilla Thunderbird
From:
   "mary had a little \"lamb,\" its fleece was white as \"snow.\" And everywhere
            Mary went the lamb was sure to \"go:" <[email protected]>
Subject: mary had a little lamb, its fleece was white as snow. And everywhere
  Mary went the lamb was sure to go:
To:
   "mary had a little \"lamb,\" its fleece was white as \"snow.\" And everywhere
            Mary went the lamb was sure to \"go:" <[email protected]>


>> Generally, I understand that Courier comes from a time where mail 
>> servers were far more commonly modifying mails in all kinds of ways. 
>> However, given DKIM and related DMARC enforcement is becoming more 
>> common and such modifications regularly break signatures, I think 
>> Courier should move to a place where it does not modify mail structures 
>> unless absolutely necessary. Ideally, this should also be the default.
>
> Yes, and in that time mail servers commonly rewrote mail headers for many 
> reasons. This directly originated from the fact that mail servers at the 
> time often connected other non-Internet mail systems, with their own formats 
> and peculiarities.
>
> So, with that being the existing status quo, what would make sense for newer 
> mail related standards to do?
>
> 1) Make them work in the way that's compatible with the existing mail 
> standards.


Senders should set the "relaxed" canonicalization.  Unfortunately, the default is "simple".


> 2) Mandate that everyone comply with them, and avoid touching mail headers.


Not touching headers, at least signed ones, would be the ideal solution to avoid breaking signatures.  After nearly two decades, it is still plenty of exceptions.


Best
Ale
-- 







_______________________________________________
courier-users mailing list
[email protected]
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users