[Enhancement] Expose finer-grained DKIM configuration through the builder api and disable 'l-param' by default

[SaeGon-Heo]

Hello bbottema!
I'm working on DKIM Signing and I have a question about default DKIMSigner config.

https://github.com/bbottema/simple-java-mail/blob/master/modules/dkim-module/src/main/java/org/simplejavamail/internal/dkimsupport/DKIMSigner.java#L47

In DKIMSigner.java it seems set l-param as true always.
But this optional param is not recommended to set in RFC6376.
And mailtrap mail service provider's DKIM document says too.

“l” – length of the message body, and “z”- list of message’s original headers (both not recommended to set).

l-param is not found in google gmail's DKIM header too

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=~~~;
        h=mime-version:from:date:message-id:subject:to;
        bh=~~~;
        b=~~~
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=~~~; s=~~~;
        h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
        bh=~~~;
        b=~~~
X-Gm-Message-State: ~~~

Is there any reason to use l-param?
If not I think l-param must be set as not use it.

[bbottema]

Interesting. To be honest I have no idea and I'm glad you referenced the relevant RFC's. I'll do some research, but know that the DKIM library used under the hood has been passed on to different hands a few times, so it's entirely possible there's no real reason behind it (anymore).

[bbottema]

I've released 8.8.0, which updates the DKIM builder api in a similar fashion as the recent S/MIM update for #498.

You can now configure lengthParam, headerCanonicalization, bodyCanonicalization and signingAlgorithm for DKIM. Here's an example from the DKIM documentation:

currentEmailBuilder.signWithDomainKey(
	DkimConfig.builder()
		.dkimPrivateKeyData(byte[] / File / InputStream)
		.dkimSigningDomain("your_domain.org")
		.dkimSelector("your_selector")
		.useLengthParam(true) // default is false
		.excludedHeadersFromDkimDefaultSigningList("From", "Subject") // default is none
		.headerCanonicalization(DkimConfig.Canonicalization.SIMPLE) // default is RELAXED
		.bodyCanonicalization(DkimConfig.Canonicalization.SIMPLE) // default is RELAXED
		.signingAlgorithm("SHA256_WITH_ED25519") // default is SHA256_WITH_RSA
		.build()
);

[SaeGon-Heo]

How fast you done with bunch of codes 😅
Thank you for taking the time to this!
I really like this.

[furkan-atak]

I wonder how can I extract the dkim signature after build it, to use it as header ? When I reconvert it from EmailBuilder to MimeMessage it broke the dkim and bh fails.

[bbottema]

Hi @furkan-atak,

If I understand correctly, you want to pull out the DKIM signature to add it in your email headers directly, but you're hitting a wall with the bh field after switching from EmailBuilder to MimeMessage? Just to clear things up, Simple Java Mail is pretty solid when it comes to converting Email objects to MimeMessages right before sending, since this is the primary use case of using DKIM. This step is meant to keep everything, including DKIM signatures, intact.

It seems like there might be a mix-up or a special case with your issue. Normally, the DKIM signature is part of the email headers, added automatically when you send the email to make sure it's legit and hasn't been tampered with. Messing with the DKIM signature manually isn't typically done because it can easily make the signature invalid, especially if you change parts of the email that the signature covers (like the bh field for the body hash).

If you really need to get at the DKIM signature before sending, I'm curious to know why. Perhaps it's a use case I might want to support. However, I'd advise caution with manual manipulations of DKIM signatures due to the precise nature of email authentication processes.

[furkan-atak]

It's because I am trying to use dkim in milter (mail filter). So it's actually does not send a mail to anywhere but it communicates with postfix (if you do not know much about postfix and milter protocol stages: https://www.postfix.org/MILTER_README.html) so because of that instead of directly signing and sending an email, I need the dkim header to add the mail headers in the related milter stage which is eom(end of message).