DKIM Signature Body Hash Does Not Verify

Discuss your pilot or production implementation with other Zimbra admins or our engineers.
User avatar
L. Mark Stone
Ambassador
Ambassador
Posts: 2802
Joined: Wed Oct 09, 2013 11:35 am
Location: Portland, Maine, US
ZCS/ZD Version: 10.0.7 Network Edition
Contact:

Re: DKIM Signature Body Hash Does Not Verify

Post by L. Mark Stone »

I think you can chalk this up as a false positive on MxToolbox's part.

Same chatter on the Office 365 forums about this, so it is not Zimbra-specific, and as Phoenix said, it does not impact email delivery at all.

Hope that helps,
Mark
___________________________________
L. Mark Stone
Mission Critical Email - Zimbra VAR/BSP/Training Partner https://www.missioncriticalemail.com/
AWS Certified Solutions Architect-Associate
User avatar
arkitoure
Posts: 18
Joined: Fri Feb 10, 2017 9:16 am

Re: DKIM Signature Body Hash Does Not Verify

Post by arkitoure »

phoenix wrote:I wouldn't have thought this would be related to the ZCS version but I always like to keep on the most recent release. I'm not really sure if Opendkim had any problems similar to this but I never had any problems with it but that was a few years ago. :)
arkitoure wrote:On Rspamd whats the eta for integration? And perhaps with a positive effect on DKIM?!
I hate to say this but you must be joking! :) Zimbra (Synacor) having any contact with a forum member is unheard of in these forums. :( There has been absolutely no contact from Zimbra regarding Rspamd although I'm a great fan of it and I'd recommend it for any ZCS installation and for an experienced admin it's fairly trivial to implement.

I'll have a think about this and see what I can come up with, although you must remember that you're talking to an amateur here, I don't do this for a day job.

Thanks again here....yes, me as well but Ive put off upgrading during an unsure time with Synacor and its plans with Zimbra. Ive been on the platform a long, long time and I wanted to see some movement in a direction that would give me confidence in the future (Zimbra X blah blah). That being said, my question was only how long it would take to implement Rspamd and its difficulty level. I read through your post on it and was intrigued. I may give it a whirl on the new setup.

I will probably move forward with an upgrade new servers, the whole nine, in the next 2 weeks. Maybe it will clear up this silly DKIM issue I am having. Until then though I'll try a few things here and there.
User avatar
arkitoure
Posts: 18
Joined: Fri Feb 10, 2017 9:16 am

Re: DKIM Signature Body Hash Does Not Verify

Post by arkitoure »

phoenix wrote:I've just sent them an email to their test account at ping@tools.mxtoolbox.com - I see the same failure as you and yet I can send mail anywhere (including google, Yahoo etc) without that problem occurring.

Well, I'm somewhat confused by the results from the MXtoolbox site as they are somewhat unexpected. It would lead me to think their validation is having problems, if you have an account with them have you tried contacting them to see if there is a problem?

Are you relaying any of the mail through another server? Here's a link that does explain the problem (and resolution) for opendkim but I don't know if it's applicable in your case: https://askubuntu.com/questions/1127344 ... ron-output

Its looking like a mxtoolbox issue as the last post clues. Funny thing is I get a 10/10 rating on mail tester so I knew something was strange. I did contact MS though and they have some issue with the IP range which is AWS based so a little strange. I'll have to dig more it seems :?
User avatar
arkitoure
Posts: 18
Joined: Fri Feb 10, 2017 9:16 am

Re: DKIM Signature Body Hash Does Not Verify

Post by arkitoure »

L. Mark Stone wrote:I think you can chalk this up as a false positive on MxToolbox's part.

Same chatter on the Office 365 forums about this, so it is not Zimbra-specific, and as Phoenix said, it does not impact email delivery at all.

Hope that helps,
Mark

Thanks Mark....yes looking like the case. I do have some issues with MS domains that may be a separate issue. I'll have to deal with their techs on this i suppose. My past interactions with them have never been too helpful :|
Post Reply