[pfx] dual-algo (rsa & ec) dkim signing of pfx-outbound mail -- incorrect receipt @ gmail. pfx, dkimpy or gmail issue?

i run dkimpy-milter with my postfix setup

outbound, it signs as intended with both rsa & ed25519 sigs

	...
	2026-07-23T08:36:19.234501-04:00 svr03 dkimpy-milter[34958]: connect from internal.mx1.example2.net at ('YY.YY.YY.YY', 34383) INTERNAL
	2026-07-23T08:36:19.234572-04:00 svr03 dkimpy-milter[34958]: mail from: <[email protected]> ('SIZE=850', 'BODY=8BITMIME')
	2026-07-23T08:36:19.278009-04:00 svr03 dkimpy-milter[34958]: From: Admin <[email protected]>
	2026-07-23T08:36:19.286247-04:00 svr03 dkimpy-milter[34958]: 4g3Wvf7eZ7r3k: rsa-sha256 DKIM signature added (s=dkim-c...5-rsa d=example.com)
	2026-07-23T08:36:19.286743-04:00 svr03 dkimpy-milter[34958]: 4g3Wvf7eZ7r3k: ed25519-sha256 DKIM signature added (s=dkim-c...5-ed25519 d=example.com)
	...

mail sent to gmail specifically fails to correctly ID/process the EC sig. mail to, e.g., fastmail -- processes just fine.

	is there any possible postfix 'interference' causing this?

or

	dkim-milter misconfig, specific to pfx usage?

i think neither is likely -- but worth asking to confirm.

i _suspect_ it's an issue @ gmail; if so, anyone here know how to communicate with 'them'? i don't have/use google/gmail accounts or services; only send mail to recipients there ...

received by fastmail, both sigs are correctly detected/verified as pass

	...
	Authentication-Results: phl-mx-04.messagingengine.com;
	    dkim=pass (2048-bit rsa key sha256) header.d=example.com
	      [email protected] header.b=fC... header.a=rsa-sha256
	      header.s=dkim-c...5-rsa;
	    dkim=pass (ed25519 key sha256) header.d=example.com
	      [email protected] header.b=uY/av3cs header.a=ed25519-sha256
	      header.s=dkim-c...5-ed25519;
	    dmarc=pass policy.published-domain-policy=reject
	      policy.published-subdomain-policy=reject
	      policy.applied-disposition=none policy.evaluated-disposition=none
	      (p=reject,sp=reject,d=none,d.eval=none) policy.policy-from=p
	      header.from=example.com;
	    iprev=pass smtp.remote-ip=XX.XX.XX.XX (mx1.example.net);
	    spf=pass [email protected]
	      smtp.helo=mx1.example.net
	...
	DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed;
	 d=example.com; [email protected]; q=dns/txt;
	 s=dkim-c...5-ed25519; t=1784810179; h=message-id : date :
	 reply-to : from : to : subject : content-type :
	 content-transfer-encoding : from;
	 bh=C...f=;
	 b=uY/av3cs...
	 5HUtV4NewjOxjIfBQ==
	DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	 d=example.com; [email protected]; q=dns/txt;
	 s=dkim-c...5-rsa; t=1784810179; h=message-id : date :
	 reply-to : from : to : subject : content-type :
	 content-transfer-encoding : from;
	 bh=C...f=;
	 b=g...e==


but at gmail,

	Authentication-Results: mx.google.com;
	       dkim=neutral (no key) [email protected] header.s=dkim-c...5-ed25519 header.b="uY/av3cs";
	       dkim=pass [email protected] header.s=dkim-c...5-rsa header.b=fC...;
	       spf=pass (google.com: domain of [email protected] designates XX.XX.XX.XX as permitted sender) [email protected];
	       dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=example.com
	...
	DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed;
	 d=example.com; [email protected]; q=dns/txt;
	 s=dkim-c...5-ed25519; t=1784810179; h=message-id : date :
	 reply-to : from : to : subject : content-type :
	 content-transfer-encoding : from;
	 bh=C...f=;
	 b=uY/av3cs...
	 5HUtV4NewjOxjIfBQ==
	DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	 d=example.com; [email protected]; q=dns/txt;
	 s=dkim-c...5-rsa; t=1784810179; h=message-id : date :
	 reply-to : from : to : subject : content-type :
	 content-transfer-encoding : from;
	 bh=C...f=;
	 b=g...e==
_______________________________________________
Postfix-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]