Re: Publishing DKIM records with tinydns

Oh, my, we have a bunch of misconceptions here.  FYI, I am an active
member of the DKIM committee, I sign all my outgoing mail with DKIM
signatures, and serve the key records from djbdns.

>> Your record isn't valid because it's missing the string length byte.

>I don't understand, my djbdns install has no patches, the record is 
>constructed as per the docs at http://cr.yp.to/djbdns

It's possible to publish TXT records using the tinydns generic syntax,
if you put in the length bytes yourself, but there's no advantage to
doing so.  The length bytes are mandatory.

>The key data is broken into two parts, so DKIM verification fails.

Ah.  Whatever you're using to do DKIM verification is broken.  The
DKIM spec is quite clear, a verifier concatenates all of the strings
in the TXT record, which it has to do since it's easy to create key
records longer than 255 bytes.

I saw some early verifiers with the one-string bug but I thought
they'd all been stamped out.  Please let us know what we're using so
we can tell the author to fix it.

The Mail::DKIM perl module does a good job of generating and checking
DKIM records.  Try using that.  I have a perl qmailqueue shim that
adds signatures if anyone would like it.

R's,
John