DKIM Signature Body Hash Does Not Verify

Discuss your pilot or production implementation with other Zimbra admins or our engineers.
User avatar
arkitoure
Posts: 18
Joined: Fri Feb 10, 2017 9:16 am

DKIM Signature Body Hash Does Not Verify

Postby arkitoure » Sun Mar 22, 2020 5:40 pm

Hello All,

Recently encountered an issue with DKIM where the signature body hash does not match/verify with the public DNS record. I have no idea why this is happening checked just about everything I can thing of. I am using mxtoolbox to run external deliverability tests.

Everything else in order but this keeps on churning out errors. Anyone seen this or have any clues on the issue?

Test results here for anyone wanting to give this a go: https://mxtoolbox.com/deliverability/34 ... b92b26857c


phoenix
Ambassador
Ambassador
Posts: 26446
Joined: Fri Sep 12, 2014 9:56 pm
Location: Liverpool, England

Re: DKIM Signature Body Hash Does Not Verify

Postby phoenix » Mon Mar 23, 2020 1:30 pm

Try the following:

Code: Select all

#su - zimbra
zimbra@mail:$ /opt/zimbra/postfix/sbin/postconf -e disable_mime_output_conversion='yes'
zimbra@mail:$ zmmtactl restart 
Regards

Bill

Rspamd: A high performance spamassassin replacement

If you'd like to see this implemented in a future version of ZCS then please vote on Bugzilla entries 97706 & 108168
User avatar
arkitoure
Posts: 18
Joined: Fri Feb 10, 2017 9:16 am

Re: DKIM Signature Body Hash Does Not Verify

Postby arkitoure » Mon Mar 23, 2020 2:21 pm

phoenix wrote:Try the following:

Code: Select all

#su - zimbra
zimbra@mail:$ /opt/zimbra/postfix/sbin/postconf -e disable_mime_output_conversion='yes'
zimbra@mail:$ zmmtactl restart 



Thx for picking this up! Tried it (with updated dir) and no cigar unfortunately.

Code: Select all

/opt/zimbra/common/sbin/postconf -e disable_mime_output_conversion='yes'


Any idea why this may be happening? Running a multi-domain setup but never seen this before in all my previous installations. I was poking around the /opt/zimbra/conf/opendkim-localnets.conf.in to see if something in there could be the cause.
User avatar
arkitoure
Posts: 18
Joined: Fri Feb 10, 2017 9:16 am

Re: DKIM Signature Body Hash Does Not Verify

Postby arkitoure » Mon Mar 23, 2020 2:43 pm

To add, here is the recent test result through mxtoolbox:

https://mxtoolbox.com/deliverability/2b53f1bb-825e-4da0-bcce-c3b0d466690e

And another strange related thing...I get no response when testing the validity of the DKIM sig against the server

Code: Select all

/opt/zimbra/common/sbin/opendkim-testkey -d stectix.com -s e8a57f5a-69e7-11ea-9bc1-b75d1679465b -x /opt/zimbra/conf/opendkim.conf


This specific domain returns crickets, nothing, yet other domains do.

:|
phoenix
Ambassador
Ambassador
Posts: 26446
Joined: Fri Sep 12, 2014 9:56 pm
Location: Liverpool, England

Re: DKIM Signature Body Hash Does Not Verify

Postby phoenix » Mon Mar 23, 2020 7:05 pm

Do you get the same result when it's sent to another test site (or google, perhaps)? Have you tried regenerating you DKIM signature for that domain?
Regards

Bill

Rspamd: A high performance spamassassin replacement

If you'd like to see this implemented in a future version of ZCS then please vote on Bugzilla entries 97706 & 108168
User avatar
arkitoure
Posts: 18
Joined: Fri Feb 10, 2017 9:16 am

Re: DKIM Signature Body Hash Does Not Verify

Postby arkitoure » Mon Mar 23, 2020 8:03 pm

phoenix wrote:Do you get the same result when it's sent to another test site (or google, perhaps)? Have you tried regenerating you DKIM signature for that domain?



Its the only domain that returns no result. I did try regen the DKIM for the domain after my last message. Same situation.

Its strange this, nothing really in the logs either to ID anything. And naturally this is causing bounced/blocked emails to major mail points like Yahoo, AOL, MS–Hotmail, etc..a serious issue.

Searched the whole net including our forums here for any tidbit of info and still a nothing burger.

I wonder could there be account and/or domain specific settings via the admin UI that would cause this issue? Maybe something is switched off/on somewhere. Lost.

Noticed your link to Rspamd...you still running this?
phoenix
Ambassador
Ambassador
Posts: 26446
Joined: Fri Sep 12, 2014 9:56 pm
Location: Liverpool, England

Re: DKIM Signature Body Hash Does Not Verify

Postby phoenix » Mon Mar 23, 2020 8:08 pm

This is strange! What size key did you generate? Could there be a problem with your DNS records? Is it all email from this particular domain that's having the problem?

Yes, I'm still running Rspamd and it's a fantastic and lightweight alternative to the ZCS antispam system.
Regards

Bill

Rspamd: A high performance spamassassin replacement

If you'd like to see this implemented in a future version of ZCS then please vote on Bugzilla entries 97706 & 108168
User avatar
arkitoure
Posts: 18
Joined: Fri Feb 10, 2017 9:16 am

Re: DKIM Signature Body Hash Does Not Verify

Postby arkitoure » Mon Mar 23, 2020 8:25 pm

2048-bit signature standard. Maybe try lesser just for kicks?

Perhaps version related?

Release 8.8.9_GA_2055.RHEL7_64_20180703080917 RHEL7_64 FOSS edition, Patch 8.8.9_P10 w/ Zextras Installed.

DNS checks out, on AWS R53 and all is well in that regard. Same format as other domains in same environ.

Bothering me enough now that Im thinking of upgrading in hopes it clears the issue. Im running production multi-server dist storage though with clients so downtime out of the blue is not a good place to be.

On Rspamd whats the eta for integration? And perhaps with a positive effect on DKIM?

Cheers for your help here!
phoenix
Ambassador
Ambassador
Posts: 26446
Joined: Fri Sep 12, 2014 9:56 pm
Location: Liverpool, England

Re: DKIM Signature Body Hash Does Not Verify

Postby phoenix » Tue Mar 24, 2020 9:07 am

I wouldn't have thought this would be related to the ZCS version but I always like to keep on the most recent release. I'm not really sure if Opendkim had any problems similar to this but I never had any problems with it but that was a few years ago. :)

arkitoure wrote:On Rspamd whats the eta for integration? And perhaps with a positive effect on DKIM?!
I hate to say this but you must be joking! :) Zimbra (Synacor) having any contact with a forum member is unheard of in these forums. :( There has been absolutely no contact from Zimbra regarding Rspamd although I'm a great fan of it and I'd recommend it for any ZCS installation and for an experienced admin it's fairly trivial to implement.

I'll have a think about this and see what I can come up with, although you must remember that you're talking to an amateur here, I don't do this for a day job.
Regards

Bill

Rspamd: A high performance spamassassin replacement

If you'd like to see this implemented in a future version of ZCS then please vote on Bugzilla entries 97706 & 108168
phoenix
Ambassador
Ambassador
Posts: 26446
Joined: Fri Sep 12, 2014 9:56 pm
Location: Liverpool, England

Re: DKIM Signature Body Hash Does Not Verify

Postby phoenix » Tue Mar 24, 2020 10:24 am

I've just sent them an email to their test account at ping@tools.mxtoolbox.com - I see the same failure as you and yet I can send mail anywhere (including google, Yahoo etc) without that problem occurring.

Well, I'm somewhat confused by the results from the MXtoolbox site as they are somewhat unexpected. It would lead me to think their validation is having problems, if you have an account with them have you tried contacting them to see if there is a problem?

Are you relaying any of the mail through another server? Here's a link that does explain the problem (and resolution) for opendkim but I don't know if it's applicable in your case: https://askubuntu.com/questions/1127344/dkim-failure-body-hash-did-not-verify-but-only-on-cron-output
Regards

Bill

Rspamd: A high performance spamassassin replacement

If you'd like to see this implemented in a future version of ZCS then please vote on Bugzilla entries 97706 & 108168

Return to “Administrators”

Who is online

Users browsing this forum: No registered users and 11 guests