Re: Generic records and DKIM

On Wed, Mar 18, 2009 at 7:19 AM, DAve <[email protected]> wrote:
> But when I dig that record I see this,
>
> ]# dig @10.0.241.66 default._domainkey.pixelhammer.com TXT +short
> "v=DKIM1\;
> k=rsa\;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjdJZZv9dOJ6JL/gZp58dkt/a9ZGt2ap051inDc9BG3UhwaU2VVrKX+XocHSS0OAQmQPtAFs"
> "2xUtJjNvs15mWaccuRIo3qB8GSJYJ+5ms3F2WfD50Mtjpb5pMVsmgkWl/lvPXGd16ddCvcIbGP84QcvtWq88DhUrCHl9ZdpiyS+wIDAQAB\;"
>
> The key data is broken into two parts, so DKIM verification fails.

tinydns-data splits TXT records into chunks at most 127 bytes long; to
change this, on line 402 of tinydns-data.c, you can change "if (k >
127) k = 127;" to something like "if (k > 255) k = 255;".  (The wire
format allows chunks up to 255; I'm guessing djb coded it this way to
avoid compatibility with clients that treated it as a signed field or
something.)

I wouldn't expect DKIM to fail because of this, but I don't know much
about it.  E.g., how big is that RSA key, 1024 bits?  What happens if
you use 2048 or 4096 bits?  The TXT record will have to be split no
matter what.  It seems like a bug in the client if it can't handle
appending multiple TXT record chunks.

Let us know if the tinydns-data.c change fixes it.