Spamassassin: DKIM_INVALID DKIM or DK signature exists, but is not valid
by mfoley from LinuxQuestions.org on (#56A60)
I have the following DKIM header info in an email sent from ohprs.org to novatec-inc.com. Both are mail servers I administer. ohprs.org has DKIM running:
Code:Authentication-Results: server.novatec-inc.com;
dkim=pass (1024-bit key) header.d=ohprs.org header.i=@ohprs.org header.b=FYQXJzAA
Received: from OHPRSstorage.hprs.local (OHPRSstorage.hprs.local [192.168.0.5])
by mail.hprs.local (8.15.2/8.15.2) with ESMTPS id 06TE5anp002378
(version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO)
for <sysadmin@mail.hprs.local>; Wed, 29 Jul 2020 10:05:36 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ohprs.org;
s=hprsmail; t=1596031536;
bh=WEWBfUYx3NlzIVPdu0EbRO0gMqHH80wFEA604yYIgDo=;
h=Date:From:To:Subject;
b=FYQXJzAAXOi566V6E7TlXPvwhPCUk91QNf7BBmUKUWZQcDiQsTFw7f/9FMjFKCmrH
Tp5vcOZ0QYsVC8UBaR296TS/Sms2nDb9TDULOlLiLQfKFReXBRn0XO+Hx3iYvep+nr
LUuOB1sBlAftdE/w8qWKe12+kXrSWlsRZPmD/7N4=I'm no expert on this, but this looks valid to me (dkim=pass). Furthermore, looking up DKIM info for ohprs.org:hprsmail on mxtoolbox.com returns:
Code:DKIM Record Published: DKIM Record found
DKIM Syntax Check: The record is valid
DKIM Public Key Check: Public key is presentAgain, indicating to me valid. However, in the same email as above I get:
Code:X-Spam-Report:
* 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
* valid
* 0.1 DKIM_INVALID DKIM or DK signature exists, but is not validIn fact, I've checked about half-a-dozen messages from different senders which have the same "dkim=pass" in the header, but all also have the Spamassassin "DKIM ... is not valid".
Is this a bug in Spamassassin or is there something truly invalid about the DKIM signature?
Code:Authentication-Results: server.novatec-inc.com;
dkim=pass (1024-bit key) header.d=ohprs.org header.i=@ohprs.org header.b=FYQXJzAA
Received: from OHPRSstorage.hprs.local (OHPRSstorage.hprs.local [192.168.0.5])
by mail.hprs.local (8.15.2/8.15.2) with ESMTPS id 06TE5anp002378
(version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO)
for <sysadmin@mail.hprs.local>; Wed, 29 Jul 2020 10:05:36 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ohprs.org;
s=hprsmail; t=1596031536;
bh=WEWBfUYx3NlzIVPdu0EbRO0gMqHH80wFEA604yYIgDo=;
h=Date:From:To:Subject;
b=FYQXJzAAXOi566V6E7TlXPvwhPCUk91QNf7BBmUKUWZQcDiQsTFw7f/9FMjFKCmrH
Tp5vcOZ0QYsVC8UBaR296TS/Sms2nDb9TDULOlLiLQfKFReXBRn0XO+Hx3iYvep+nr
LUuOB1sBlAftdE/w8qWKe12+kXrSWlsRZPmD/7N4=I'm no expert on this, but this looks valid to me (dkim=pass). Furthermore, looking up DKIM info for ohprs.org:hprsmail on mxtoolbox.com returns:
Code:DKIM Record Published: DKIM Record found
DKIM Syntax Check: The record is valid
DKIM Public Key Check: Public key is presentAgain, indicating to me valid. However, in the same email as above I get:
Code:X-Spam-Report:
* 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
* valid
* 0.1 DKIM_INVALID DKIM or DK signature exists, but is not validIn fact, I've checked about half-a-dozen messages from different senders which have the same "dkim=pass" in the header, but all also have the Spamassassin "DKIM ... is not valid".
Is this a bug in Spamassassin or is there something truly invalid about the DKIM signature?