> On 13 Oct 2026, at 13:33, Bastian Blank <[email protected]> wrote:
>
> On Tue, Oct 13, 2026 at 01:21:36PM +0200, Benny Pedersen via mailop wrote:
>> Cor Bosman via mailop skrev den 2026-10-13 13:04:
>>> Hi all, we’ve noticed that outlook is returning 4xx for forwards with a
>>> valid DKIM because there is a duplicate signed header. Usually a
>>> Mime-Version header.
>
> Please provide an example, headers and esp signature.
>
> Mime-Version is not defined with "at most one" as far as I can see. RFC
> 2045 does not talk about it and the IETF registry does also not record
> such a restriction. Only headers defined directly in RFC 5322 show
> restrictions.
Incoming email from TikTok.
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=i.service.tiktok.com;
h=mime-version:mime-version:from:list-unsubscribe-post:date:subject:
list-id:list-unsubscribe:reply-to:to:content-type:content-transfer-encoding:
cc:content-type:date:from:subject:to;
s=s1; t=1791800266;
bh=/7p6XTtU1EUrFGpsW+nqzKgEX+cvX9RLISHNLg1j+nk=;
b=V0wmn6gsJ2fAZ3VJXRXyC/T6Xzuqu2HM/r6dRE6j13f2auX96WiP5OWluZTGXkGmT6Sz
ju8TefcEM7XEb16tmO8d23YKGxZd6+IhqM4xX//AnKB8+L3WTBEQGCXyzNvZo9e2ISQWt5
vraglLUAeAYMZJndRrhqRiGmI/jPnZvsZaGOjTcWK1tq5Eq+s2bZ2vDw8enQQbFWOlqcxj
aiICLoiSOYSB5R7hXsjUVuBRJ1HvmvOBzGWQW5HAdQutPKzi22oCxCfjSKnome5QF6/147
XUuRA9S1C5rRlmN1nxIOoICp7YBxnkt3KAZClWLFttxPBBzdWmzL9IvY1gUGXNVQ==
h=mime-version:mime-version:from:...:content-type:...:cc:content-type:date:from:subject:to
And they indeed have 2 mime-version headers.
We arc sign it on our forwarder:
ARC-Message-Signature i=2 bh=/7p6XTtU1EUrFGpsW+nqzKgEX+cvX9RLISHNLg1j+nk=
Microsoft rejects it with a DMARC fail.
I also found this url, where they see the same issue:
https://www.postmastery.com/outlook-deliverability-a-silent-shift-with-serious-consequences/
And I actually just reproduced it. I created 2 messages and sent them both to
an outlook address. Here are the sources:
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=soverin.net;
s=soverin1; h=mime-version:mime-version:from:to:subject:date:message-id;
bh=Wvyf+lLwxObd+lh3f1DNhNvJri+FedyyRucN37E3zpE=;
b=vSG7VyVHWY0ZcvD8Xe/Pdpk147glGVIdquEq5wYiKaWTHf2rf8+Jwh4SBsUnaQp4l3dCMJzaYlYssaNXGuYnqfzJeidBZwqST+G+zv8tCIBq5SN8XHs4Pnqaq7FXii+BbbqOrUW00VGFuMsD0//+kJZb0WKw2IUpGAw4a19Peb3qJ18aydH11FlBvms/7PaHTW+Oh3k9Vn0W51Vum0wFLcdA6EqL8geDZDgwDgwCv17/TKvNtkf7CcHPH26ZiLyVm+h6tMQWtPP9KQoN5rXyG+Tb45Oir4GGeAwXYnjBqAvNmfd5eV2iq3+Z0NZPZ4rle8AU+n2DqTGbe9Il6Xm1fw==
From: [email protected]
To: [email protected]
Subject: dkim mime-dup
Date: Tue, 13 Oct 2026 12:20:00 +0000
Message-ID: <[email protected]>
MIME-Version: 1.0
MIME-Version: 1.0
X-Test: one
dup
<** 550 5.7.509 Access denied, sending domain [SOVERIN.NET] does not pass DMARC
verification and has a DMARC policy of reject.
[GVXPR02MB12000.eurprd02.prod.outlook.com 2026-10-13T12:14:20.020Z
08DF2874F6774684] [AS9P309CA0015.EURP309.PROD.OUTLOOK.COM
2026-10-13T12:14:20.015Z 08DF25C30B9D1E48]
[AMS1EPF0000009C.eurprd02.prod.outlook.com 2026-10-13T12:14:20.033Z
08DF252C2AE1E1DB]
,
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=soverin.net;
s=soverin1; h=mime-version:from:to:subject:date:message-id;
bh=UlnUaklkS/dnkiMe9zFbUpNnfEnd1+adlVVwE+EDINQ=;
b=JQ/MAK3osWvXr1IpbIMdsK0/VowN8KIHqTR3mMTursPMqzdEaziFqYGNqn9qRJN0WMVoUfRD35Ux81ShdGDejv4laIFG/B2r3rR/H/WwBQdUB7x23PAFfgABLXdaALBQuRcBn6jwrCrMlo2b+bhwdDxa7xSikOXrRqvS394rGI5UecbuDt249UmUe2XPrP6/wveeSRxWZ9wl8G/7TMM0U+8Ck7MJt8SOqiCI6faG4QRSr5SLxpnriBeag6hRrZTFEBYfL3A2UHbdb/qVlpfAW8ZA5f/tmR3n+xwDUCRKiHeQ9qYVNYue2i2GBu4V8MjlBPY46iHUhcFK4Vm4dqoqFg==
From: [email protected]
To: [email protected]
Subject: dkim mime-one
Date: Tue, 13 Oct 2026 12:20:01 +0000
Message-ID: <[email protected]>
MIME-Version: 1.0
X-Test: one
one
<- 250 2.6.0 <[email protected]> [InternalId=51470888083502,
Hostname=AS8PR02MB9529.eurprd02.prod.outlook.com] 9551 bytes in 0.204, 45.572
KB/sec Queued mail for delivery -> 250 2.1.5
Regards,
Cor
_______________________________________________
mailop mailing list -- [email protected]
To unsubscribe send an email to [email protected]
