Re: A lot of "invalid DKIM result" messages in my logs

it appears that the inbound mail from ipfire is DUAL signed, both RSA and ED25519 algos

	2024-11-17T09:12:31.898818+00:00 mail-www amavis[2068017]:
	(2068017-11) dkim: VALID Author+Sender+MailFrom signature by
	d=community.ipfire.org, From: <[email protected]>,
	a=rsa-sha256, c=relaxed/relaxed, s=202003rsa,
	[email protected],
	m.list(ml:static/dynamic-routing.networking.community.ipfire.org)

	2024-11-17T09:12:32.176335+00:00 mail-www amavis[2068017]:
	(2068017-11) dkim: FAILED Author+Sender+MailFrom signature by
	d=community.ipfire.org, From: <[email protected]>,
	a=ed25519-sha256, c=relaxed/relaxed, s=202003ed25519,
	[email protected],
	m.list(ml:static/dynamic-routing.networking.community.ipfire.org),
	invalid (unsupported algorithm ed25519-sha256)


Mail::DKIM has been ED25519 capable for awhile, since Jul '23,

	EdDSA (ed25519) support
	https://github.com/fastmail/mail-dkim/issues/9
	https://github.com/fastmail/mail-dkim/pull/18

But authenticator consumers of Mail::DKIM have not necessarily been updated.
e.g., fastmail authentication milter was just updated a few days ago,

	verification fails for rfc8463-mandate ed25519-signed dkim keys: "unsupported algorithm ed25519-sha256" #123
	https://github.com/fastmail/authentication_milter/issues/123

resolving longstanding similar authentication 'invalid' or 'unsupported' logs, e.g.

	dkim=invalid (unsupported algorithm ed25519-sha256, 0-bit key)

now, with updated authenticator, it's

	Authentication-Results: phl-mx-05.messagingengine.com;
	    dkim=pass (2048-bit rsa key sha256) header.d=example.com
	      [email protected] header.b=M... header.a=rsa-sha256
	      header.s=dkim-XXXXXX-rsa;
	    dkim=pass (ed25519 key sha256) header.d=example.com
	      [email protected] header.b=+... header.a=ed25519-sha256
	      header.s=dkim-XXXXXX-ed25519;


fwiw, GMail _still_ fails to handle dual signatures

	Authentication-Results: mx.google.com;
        dkim=neutral (no key) [email protected];
        dkim=pass [email protected] header.s=dkim-XXXXXX-rsa header.b=w...;
        spf=pass (google.com: domain of [email protected] designates XX.XX.XX.XX as permitted sender) [email protected];
        dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=example.com

, logging, in its case, a 'neutral (no key), rather than an 'invalid' or 'fail'.  repeated comms to _them_ re: the issue have been ignored over the past year.

not hard to find/log providers that can't handle ED25519 algos at all, others that can't manage DUAL signatures, and in both cases differences in policy treatment -- fail vs ignore.

look to your inbound authenticator code (amavisd? spamd?) *using* the Mail::DKIM mod

sounds like standalone SA has a fix / workaround already? if so, leaning to amavisd as the culprit.
i use neither -- rather fm's auth milter -- so can't say definitively. but i suspect ...