Re: What breaks the validity of DKIM signature?

On 2025-12-20 at 17:54:26 UTC-0500 (Sat, 20 Dec 2025 23:54:26 +0100)
Thomas Barth via users <[email protected]>
is rumored to have said:

> Hi
>
> Am 2025-12-20 22:16, schrieb A.Schulze via users:
>> Am 20.12.25 um 13:28 schrieb Thomas Barth via users:
>>> Dez 20 08:00:40 mx1 opendmarc[957]: BBB3460101: firstmallorca.com 
>>> pass
>>>
>>> But SA comes to the result DKIM_INVALID with a high value for 
>>> DMARC_REJEC
>>
>> Hello,
>>
>> how large ist the message? I remember a decade ago, amavis did not 
>> handover 100% of large messages to SA for performance reasons.
>> And SA seeing only partial content, can't validate correct.
>>
>> Andreas
>
> The size is
> size.physical: 285764
> size.virtual: 291435
>
> There is indeed a limit in /etc/amavis/conf.d/20-debian_default:
> $sa_mail_body_size_limit = 200*1024;
>
> If this limit is the reason, then SA should ignore DKIM and DMARC 
> scoring.

SA knows nothing about Amavis and its configuration. SA can only process 
what it is given.

200KB was a very good size limit for SpamAssassin 2.x but between the 
advances in hardware and the great improvements in SA performance, you 
can feel safe increasing the limit tenfold.

> But the body wasn't even part of the signature:
> tag h=Subject:From:Reply-To:To:Date:Message-ID:X-MC-User:Feedback-ID: 
> List-ID:List-Unsubscribe:List-Unsubscribe-Post:Content-Type: 
> MIME-Version:CC:Date:Subject:From

The body is ALWAYS part of the signature. There's a body hash field and 
a signature of the selected headers plus that body hash.

> I wait for a mail from firstmallorca again. I ve prepaid my system for 
> comparing a raw email (copy saved before Amavis) with the delivered 
> and saved email at the end. My DKIM checker already confirmed in 
> another mail that adding a "Delivered-to" and "Received" row to the 
> header doesnt break the signature.
>
> Best regards
> Thomas B.


-- 
  Bill Cole
  [email protected] or [email protected]
  (AKA @[email protected] and many *@billmail.scconsult.com 
addresses)
  Not Currently Available For Hire