DKIM-Signature Tag Order RSS Back to forum
2
@tyler:
Hello tyler,
Thank you for reporting this issue. You are absolutely right, only the key record must start with the version tag. I have forwarded your findings to our developers and they have confirmed that this is not an intended behavior and the bug will be fixed in the next version of ORF*.
*As most DKIM signatures start with the version tag, and a signature validation error does not cause the blacklisting of the email by default, the risk of false positive results is minimal.
Once again, thank you for reporting this.
I have some incoming emails fail to verify DKIM with the message "Error checking the DKIM signature: version tag at invalid position (v=1)." The signature does indeed have the version tag listed second, after algorithm -- an uncommon ordering to be certain.
However, I can't find anything in the DKIM spec that requires a particular order. RFC6376 section 3.6.1 requires the "v=DKIM1" tag be first, but that only applies to the related DNS record.