Issue DKIM signature contains h=Received

[raivok]

Hi,

after migrating from plesk 17 to 18 some mailservers fails to verify DKIM - DKIM-Result: fail (wrong body hash:
this happen with mail.com and some others mailservers

Gmail is ok.


And DKIM signature contains h=Recived: tag
But i read that signature must not contain Recived

DomainKeys Identified Mail (DKIM) Signatures Point 5.5

The following header fields SHOULD NOT be included in the signature:
Return-Path
Received
Comments, Keywords
Bcc, Resent-Bcc
DKIM-Signature

CentOS Linux 7.9.2009 (Core)
Plesk Obsidian Version 18.0.35 Update #1

And installed amavisd-new

Best regards

 

[SherieWright]

1. Generate DKIM keys.
2. Enter Public key to DNS Server.
3. Enter Private key to Email Server.
4. Test DKIM Record official website

 

[raivok]

I followed this recommendation, unfortunately did not help - After migration DKIM verification fails: dkim=fail (body hash did not verify)

If i use webmail - Roundcube, then no Received tag added to dkim signature, if i use external mailclient, like Thunderbird, then dkim signature have Received tag. And now i sent mail from Horde webmail . Received tag added twice....
h=Received:Received:From:To:Subject;

 

[hyazinth]

My story: I had the same issue on fresh Ubuntu+Plesk. I could not find the cause and finally get broke Postfix
My resolve path:

1. Tools&Settings -> Plesk -> Updates: Uninstall Postfix by installing Qmail, then install Postfix by uninstalling Qmail
2. Tools&Settings -> Mail -> Mail Server Settings: Check if signing of outgoing mails are enabled
3. Websites&Doamins -> Mail -> Mail Settings: Force using your server ip and enable use DKIM
4. Websites&Domains -> Hosting&DNS -> DNS Settings: add for any case in spf a:webmail.example.com Can cause by next steps fails if lack
5. by SSH # etc/postfix: in main.cf uncomment and set correct myhostname, mydomain and myorigin
6. Wait, wait…. then by SSH # dig default._domainkey.example.com txt: Your new key is already updated / cached?
7. Mxtoolbox = pass, dkimvalidator = pass, Google fails now! Before Google was OK, all others failed
8. Google DNS flush. Wait, wait… perfect! All over is signed now. Done!

Btw. Test only with new emails no forwarded, re: or so!

 

[raivok]

My story: I had the same issue on fresh Ubuntu+Plesk. I could not find the cause and finally get broke Postfix
My resolve path:

Oh joy!

But since there are currently only a few mailservers, there DKIM fail (one of them is our government mailserver), I'm probably leaving things as they are at the moment ...
Mxtoolbox = pass, dkimvalidator = pass, Google = pass, port25 = pass

Thank You @hyazinth !
Best regards!