Skip to content

Add SignHeaders From#48

Merged
lvicainne merged 1 commit into
lvicainne:mainfrom
umd-cs:main
Mar 24, 2025
Merged

Add SignHeaders From#48
lvicainne merged 1 commit into
lvicainne:mainfrom
umd-cs:main

Conversation

@seriv

@seriv seriv commented May 12, 2024

Copy link
Copy Markdown
Contributor

From the man opendkim.conf:
OversignHeaders (dataset)
Specifies a set of header fields that should be included
in all signature header lists (the "h=" tag) once more than
the number of times they were actually present in the signed
message. The set is empty by default.
The purpose of this, and especially of listing an absent
header field, is to prevent the addition of important fields
between the signer and the verifier. Since the verifier would
include that header field when performing verification
if it had been added by an intermediary, the signed message
and the verified message were different and the verification
would fail. Note that listing a field name here and not
listing it in the SignHeaders list is likely to generate
invalid signatures.

From the man opendkim.conf:
   OversignHeaders (dataset)
      Specifies  a  set of header fields that should be included
      in all signature header lists (the "h=" tag) once more than
      the number of times they were actually present in the signed
      message.  The set  is  empty  by  default.
      The purpose of this, and especially of listing an absent
      header field, is to prevent the addition of important fields
      between the signer and the verifier.  Since the verifier would
      include  that  header  field when  performing  verification
      if it had been added by an intermediary, the signed message
      and the verified message were different and the verification
      would fail.  Note that listing a field name here and not
      listing it in the SignHeaders list is likely to generate
      invalid signatures.
@lvicainne
lvicainne merged commit ad1bde6 into lvicainne:main Mar 24, 2025
@lvicainne

Copy link
Copy Markdown
Owner

Thank you for this contribution

@Dan33l

Dan33l commented Jun 26, 2025

Copy link
Copy Markdown
Contributor

This PR looks to be a breaking change.

Opendkim manual says :

SignHeaders: Specifies the set of header fields that should be included when generating signatures. If the list omits any header field that is mandated by the DKIM specification, those fields are implicitly added. By default, those fields listed in the DKIM specification as "SHOULD" be signed (RFC6376, Section 5.4) will be signed by the filter.

https://datatracker.ietf.org/doc/html/rfc6376#section-5.4.1

Before this commit mails from my MTA have h=Subject:To:From:Date, after only h=From

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants