DKIM signature from gmail gets invalid

[tkrz_brumm]

Hi!

We have implemented the Proxmox Maqil Gateway in fron of another spamfilter. Certain messages (with attachments) from gmail are changed, so the spamfilter behind is rejecting the message with invalid DKIM.

This is the issue described in this post: https://forum.proxmox.com/threads/invalid-incoming-dkim-signature.80869/

I have tried to disable filter, setting the spam size to 50000000, but the body stilkl gets changed.

Matthias

 

[Stoiko Ivanov]

please post the logs for such a mail - and verify that spam size is at least as large as the maximum message size.

 

[tkrz_brumm]

Hi!

Log of PMG:

2026-07-15T08:35:34.334523+02:00 pmailgwmsp postfix/smtpd[56196]: connect from mail-ed1-x536.google.com[2a00:1450:4864:20::536]
2026-07-15T08:35:34.434806+02:00 pmailgwmsp postfix/smtpd[56196]: 6A1F380210: client=mail-ed1-x536.google.com[2a00:1450:4864:20::536]
2026-07-15T08:35:34.435306+02:00 pmailgwmsp postfix/cleanup[56599]: 6A1F380210: message-id=<CAENh5eanCnW7Be3s-eo+28-6-DTA_FODhHv4vg7SmkC87p6Gwg@mail.gmail.com>
2026-07-15T08:35:34.493556+02:00 pmailgwmsp postfix/qmgr[909]: 6A1F380210: from=<matthias.brumm@gmail.com>, size=267110, nrcpt=1 (queue active)
2026-07-15T08:35:34.505684+02:00 pmailgwmsp postfix/smtpd[56196]: disconnect from mail-ed1-x536.google.com[2a00:1450:4864:20::536] ehlo=2 starttls=1 mail=1 rcpt=1 bdat=2 quit=1 commands=8
2026-07-15T08:35:34.547937+02:00 pmailgwmsp pmg-smtp-filter[58180]: 806696A572A3682B74: new mail message-id=<CAENh5eanCnW7Be3s-eo+28-6-DTA_FODhHv4vg7SmkC87p6Gwg@mail.gmail.com>
2026-07-15T08:35:35.487708+02:00 pmailgwmsp pmg-smtp-filter[58180]: 806696A572A3682B74: SA score=0/5 time=0.363 bayes=undefined autolearn=disabled hits=DKIM_SIGNED(0.1),DKIM_VALID(-0.1),DKIM_VALID_AU(-0.1),DKIM_VALID_EF(-0.1),DMARC_PASS(-0.1),FREEMAIL_FROM(0.001),HTML_MESSAGE(0.001),RCVD_IN_DNSWL_NONE(-0.0001),SPF_HELO_NONE(0.001),SPF_PASS(-0.001),T_FREEMAIL_DOC_PDF(0.01)
2026-07-15T08:35:35.489789+02:00 pmailgwmsp postfix/smtpd[54584]: connect from localhost.localdomain[127.0.0.1]
2026-07-15T08:35:35.490976+02:00 pmailgwmsp postfix/smtpd[54584]: 77D858066B: client=localhost.localdomain[127.0.0.1], orig_client=mail-ed1-x536.google.com[2a00:1450:4864:20::536]
2026-07-15T08:35:35.494037+02:00 pmailgwmsp postfix/cleanup[56599]: 77D858066B: message-id=<CAENh5eanCnW7Be3s-eo+28-6-DTA_FODhHv4vg7SmkC87p6Gwg@mail.gmail.com>
2026-07-15T08:35:35.497985+02:00 pmailgwmsp postfix/qmgr[909]: 77D858066B: from=<matthias.brumm@gmail.com>, size=267324, nrcpt=1 (queue active)
2026-07-15T08:35:35.498430+02:00 pmailgwmsp postfix/smtpd[54584]: disconnect from localhost.localdomain[127.0.0.1] ehlo=1 xforward=1 mail=1 rcpt=1 data=1 commands=5
2026-07-15T08:35:35.498779+02:00 pmailgwmsp pmg-smtp-filter[58180]: 806696A572A3682B74: accept mail to <matthias.brumm@msp-test.tkrz.de> (77D858066B) (rule: default-accept)
2026-07-15T08:35:35.499842+02:00 pmailgwmsp pmg-smtp-filter[58180]: 806696A572A3682B74: processing time: 0.961 seconds (0.363, 0.047, 0.526)
2026-07-15T08:35:35.500060+02:00 pmailgwmsp postfix/lmtp[56108]: 6A1F380210: to=<matthias.brumm@msp-test.tkrz.de>, relay=127.0.0.1[127.0.0.1]:10024, delay=1.1, delays=0.07/0/0.04/0.96, dsn=2.5.0, status=sent (250 2.5.0 OK (806696A572A3682B74))
2026-07-15T08:35:35.500133+02:00 pmailgwmsp postfix/qmgr[909]: 6A1F380210: removed
2026-07-15T08:35:39.769722+02:00 pmailgwmsp postfix/smtp[56182]: 77D858066B: to=<matthias.brumm@msp-test.tkrz.de>, relay=2a02:f08:a:1341::100[2a02:f08:a:1341::100]:25, delay=4.3, delays=0.01/0/4.2/0.1, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as B34833FE8B)
2026-07-15T08:35:39.770118+02:00 pmailgwmsp postfix/qmgr[909]: 77D858066B: removed

The problem is this newline:

</blockquote></div>
</blockquote></div>
</blockquote></div>
</blockquote></div>
</blockquote></div>
</blockquote></div>
</blockquote></div>
</blockquote></div>
</blockquote></div>

--000000000000ccf71c0656a08767--

--000000000000ccf71d0656a08769
Content-Type: application/pdf; name="Theaterplakat_Bunbury (3).pdf"
Content-Disposition: attachment; filename="Theaterplakat_Bunbury (3).pdf"
Content-Transfer-Encoding: base64
Content-ID: <f_mrlph8u00>
X-Attachment-Id: f_mrlph8u00

directly sent to another mailserver:

</blockquote></div>
</blockquote></div>
</blockquote></div>
</blockquote></div>
</blockquote></div>
</blockquote></div>
</blockquote></div>
</blockquote></div>
</blockquote></div>

--000000000000ccf71c0656a08767--
--000000000000ccf71d0656a08769
Content-Type: application/pdf; name="Theaterplakat_Bunbury (3).pdf"
Content-Disposition: attachment; filename="Theaterplakat_Bunbury (3).pdf"
Content-Transfer-Encoding: base64
Content-ID: <f_mrlph8u00>
X-Attachment-Id: f_mrlph8u00

If I check the body hash after deleting this newline, the hash is correct.

max spam size is 83886080, max message size is 83886080

Matthias