opendkim: add AddCanonicalizedData option for RFC 9991 forensic reporting - #423
Merged
thegushi merged 2 commits intoJul 21, 2026
Conversation
added 2 commits
July 21, 2026 13:41
…ting Adds an opt-in AddCanonicalizedData directive that emits X-DKIM-Canonicalized-Header/-Body milter headers, tagged with the signature's d=/s= values, for every verified signature. Reuses the canonicalization tmp-file capture and base64 encoding already built for the unrelated SendReports feature, so a downstream DMARC filter (e.g. OpenDMARC) can populate the RFC 6591 ARF fields required by RFC 9991 forensic reports without verifying DKIM itself.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds an opt-in
AddCanonicalizedDataconfig directive (default off) that, for every verified signature, addsX-DKIM-Canonicalized-Header/X-DKIM-Canonicalized-Bodymilter headers containing base64-encoded canonicalized header/body bytes, tagged with the signature'sd=/s=values.This is a wiring task rather than new capture logic: the canonicalized bytes are already computed and captured in tmp files today for the unrelated
SendReportsfeature (RFC 6591 signature-failure self-reports).AddCanonicalizedDataexposes that same data unconditionally (pass or fail) via milter headers instead, using the existingdkim_sig_getreportinfo()anddkimf_base64_encode_file()as-is.The motivating use case: a downstream DMARC filter (e.g. OpenDMARC) needs these bytes to populate the
DKIM-Canonicalized-Header/-BodyRFC 6591 ARF fields required by RFC 9991 forensic (ruf=) reports, but never verifies DKIM itself, so it has no canonicalized bytes of its own to report. Reading these headers back out and stripping them before final delivery is out of scope for this repo.AddCanonicalizedDataboolean directive, documented inopendkim.conf.5.in/opendkim.conf.sample.DKIM_LIBFLAGS_TMPFILESonly (neverKEEPFILES), same asSendReports.d=...; s=...;so a consumer can match by domain/selector without needing a numeric index.dkimf_base64_encode_file()'s existing fold style as-is; it already matches this codebase's own multi-line milter header convention.Test plan
autoreconf -fi && ./configure --enable-lua && make check— all 174 libopendkim tests and all 33 opendkim/miltertest tests pass, including a newt-verify-canondatacase that checks a passing signature gets both new headers with the exact expected tagged/folded base64 value.