On Sun, 2021-04-11 at 04:13 +0200, Thomas Bohl wrote:
> Hello,
>
> > In the filter-dkimsign readme I suggest to use 2048 and I stand by it.
>
> Thanks for mentioning and coding filter-dkimsign! Somehow I was unaware
> of it. I used rspamd just for DKIM. Which is overkill. The daemon racks
> up nearly 28000 daily DNS requests to free services (like dnswl.org,
> senderscore.com, spamhaus.org etc.) just by running. (I didn't use it as
> an inbound filter. I overwrote rbl.conf. I have no clue what it is
> doing.) So I switched to filter-dkimsign.
Glad you like it.
>
> I also switched to a 2048 bits key. Which looks good so far. Ironically
> only dkimvalidator.com had a problem verifying until I relaxed the
> canonicalization algorithms.
That´s weird. I just tested this with simple/simple, relaxed/simple,
relaxed/relaxed and simple/relaxed, all with a 2048 bits key, but all my
messages got accepted. Can you reproduce this issue and share me the
content of the mail (ncluding headers) that had the issue?
> (Other tests like mail-tester.com or github.com/lieser/dkim_verifier had
> no problem with it being simple.)
>
Cool, it´s always good to hear from more test-cases.
martijn@
