/ 
Mail-DKIM2-0.29

Changes for version 0.29 - 2026-11-03

  • draft-ietf-dkim-dkim2-spec-09 and draft-ietf-dkim-dkim2-dns-03. Nothing changes on the wire: what is hashed and signed is as in 0.28. Verification results change as below.
  • A null body Recipe is a PERMERROR: "Message-Instance m=<x> has a null recipe", naming the instance that holds it (sections 13, 14.2). It used to be a pass with fully_verified() false. fully_verified() is deprecated and now true exactly for a pass (still false under HeadersOnly/InstancesOnly).
  • Signers sign over their own (unsigned) null body Recipe: the message PERMERRORs downstream, but the hop's header changes are signed. Gate's AllowNullBodyRecipe, dkim2-milter's and dkim2sign's --allow-null-body-recipe and DKIM2Sign's allow_null_body_recipe are deprecated: still accepted, they do nothing, and a true value warns once. A caller passing AllowNullBodyRecipe => 0 now signs its own null where it used to refuse it. The gate no longer gives reason "null-body-recipe". A null that arrived already signed fails the upstream verification and is refused (upstream-chain).
  • Authentic From, upwards (sections 3.8, 7.1 item 4, 11.1, 14.8): a d= below the From domain makes the From Authentic unless that domain's Domain Policy Record (TXT at _domainkey.<domain>, v=DKIM1; f=strict) forbids it. Looked up only in that case, once per domain per message, never prefetched. New Verifier option PolicyCallback (and set_policy_callback, fetch_domain_policy); without it the lookup goes through Resolver with query(). A PubkeyCallback-only caller should add a PolicyCallback, or the lookup uses a default resolver. A record beginning v=DKIM1 that does not parse counts as f=strict.
  • The Signer may sign with a d= below the From domain too, after the same policy lookup (Signer options PolicyCallback and Resolver, fetch_domain_policy); strict, multiple or unavailable refuses, with the reason after "From header field is not Authentic for d=...: ". dkim2-milter, dkim2sign and DKIM2Sign pass their dns.json or resolver. New Common::from_pair_error, query_domain_policy, policy_from_source.
  • New section 14.8 strings: "From <dom> forbids subdomain signing", "From has more than one address", "From uses a domain literal", "policy for <dom> unavailable" (TEMPERROR), "multiple records for <dom> policy" (PERMERROR).
  • Key records: TXT records at the selector that begin with a v= other than DKIM1 are ignored before "has multiple records" is judged (section 3.7). New Common::key_records, domain_policy, from_mailbox.
  • An RSA key under 1024 bits is "public key <s> too short" (was "is malformed"); still refused.
  • Strings: "<field> m=/i=<n> is duplicated" (was "appears more than once"); "recipe <path> is invalid" (lower case); "mf= and d= do not match" (was "MAIL FROM and d="); no DKIM2 header fields at all: details "NONE: No DKIM2 header fields found".
  • New check: "PERMERROR: DKIM2-Signature i=1 has an exploded flag", before any key is fetched.
  • X-DKIM2-Info: draft=ietf-dkim-dkim2-spec-09 (debug-header-03).
  • Key and policy record parsing trims white space in linear time (a TXT record is whatever the signer's DNS serves).

Documentation

dkim2-milter
Standalone DKIM2 milter for Postfix

Modules

Mail::DKIM2
DKIM2 signing and verification for email
Mail::DKIM2::BodyHasher
the body hash of a message, streamed
Mail::DKIM2::BodyPlan
every Message-Instance's body hash in one pass
Mail::DKIM2::Common
Canonicalization, hashing, folding and key handling for DKIM2
Mail::DKIM2::DSN
DKIM2-signed Delivery Status Notifications
Mail::DKIM2::Digest
SHA-2 over message content, by OpenSSL where it can
Mail::DKIM2::Gate
decide whether a front end may sign a message
Mail::DKIM2::HeaderParser
Streaming message parser base for Signer and Verifier
Mail::DKIM2::HeaderPlan
every Message-Instance's header hash without undo
Mail::DKIM2::MessageInstance
Compute, verify and undo Message-Instance headers
Mail::DKIM2::MessageStore
Keep message snapshots keyed by Message-Instance
Mail::DKIM2::Reflector
verify-and-reflect DKIM2 demonstration logic for dkim2.com
Mail::DKIM2::Signature
One DKIM2-Signature header, parsed or under construction
Mail::DKIM2::Signer
Sign a message with a DKIM2-Signature header
Mail::DKIM2::Split
Bcc-safe recipient grouping before DKIM2 signing
Mail::DKIM2::TagValueList
The tag=value list a DKIM2 header is made of
Mail::DKIM2::Validate
structured per-level DKIM2 and Message-Instance report
Mail::DKIM2::Verifier
Verify the DKIM2-Signature chain on a message
Mail::DKIM2::Wrap
wrap a single-part message in a one-part multipart/mixed
Mail::Milter::Authentication::Handler::DKIM2Sign
Handler class for DKIM2 signing
Mail::Milter::Authentication::Handler::DKIM2Verify
Handler class for DKIM2 signature verification

Examples

Other files