Re: Generic records and DKIM

Matthew Dempsky wrote:
> On Wed, Mar 18, 2009 at 7:19 AM, DAve <[email protected]> wrote:
>> But when I dig that record I see this,
>>
>> ]# dig @10.0.241.66 default._domainkey.pixelhammer.com TXT +short
>> "v=DKIM1\;
>> k=rsa\;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjdJZZv9dOJ6JL/gZp58dkt/a9ZGt2ap051inDc9BG3UhwaU2VVrKX+XocHSS0OAQmQPtAFs"
>> "2xUtJjNvs15mWaccuRIo3qB8GSJYJ+5ms3F2WfD50Mtjpb5pMVsmgkWl/lvPXGd16ddCvcIbGP84QcvtWq88DhUrCHl9ZdpiyS+wIDAQAB\;"
>>
>> The key data is broken into two parts, so DKIM verification fails.
> 
> tinydns-data splits TXT records into chunks at most 127 bytes long; to
> change this, on line 402 of tinydns-data.c, you can change "if (k >
> 127) k = 127;" to something like "if (k > 255) k = 255;".  (The wire
> format allows chunks up to 255; I'm guessing djb coded it this way to
> avoid compatibility with clients that treated it as a signed field or
> something.)

Hmmm, so the cdb file created would have the data split? I tried it on a 
test server, no change.

> 
> I wouldn't expect DKIM to fail because of this, but I don't know much
> about it.  E.g., how big is that RSA key, 1024 bits?  What happens if
> you use 2048 or 4096 bits?  The TXT record will have to be split no
> matter what.  It seems like a bug in the client if it can't handle
> appending multiple TXT record chunks.

Surely I am not the only one serving DKIM from tinydns?

DAve

-- 
"Posterity, you will know how much it cost the present generation to
preserve your freedom.  I hope you will make good use of it.  If you
do not, I shall repent in heaven that ever I took half the pains to
preserve it." John Quincy Adams

http://appleseedinfo.org