dkim header fields

[Mudgee Host]

Hi,

while tracking down a dkim issue 'body hash did not verify' I have come across something odd with proxmox -
The signature lists what fields where used to create the signature, and although duplicate fields are permitted, they only make sense if a mail has duplicate headers - https://datatracker.ietf.org/doc/html/rfc6376#section-5.4.2

the fields in my signature are:

h=cc:content-type:content-type:date:from:from:message-id:mime-version:reply-to:subject:subject:to:to;

• content-type twice (sure a mail can have two parts)
• from twice (nope, only one of those)
• subject twice (nope, only one of those)
• to twice (nope, only one of those too)

doesn't look right, but I can't see where this is configured?

 

[Stoiko Ivanov]

Adding a header multiple times ensures that the signature fails if someone in the middle injects another header (e.g. from) - it's also called oversigning - e.g.:
https://forum.dmarcian.com/t/oversigning-headers-what-is-it-and-how-does-one-do-it/2462/2

I hope this explains it!

 

[Mudgee Host]

ah thank you - yes that makes sense.