Postfix
僅 CRON 作業上的 DKIM 簽名失敗
我最初在askubuntu上發布了這個，但那裡沒有任何回應。
我已經在我的伺服器上成功安裝了 Postfix 和 OpenDkim，它正確地簽署了來自多個不同域的郵件。我們將稱為 webhost.example.com 的主機。它執行 Ubuntu 18.04.2 LTS、Postfix 3.3.0 和 OpenDKIM v2.11.0
今天，我想從發送到我的 Gmail 帳戶的一些 CRON 作業中獲取輸出，因此我在 KeyTable 和 SigningTable 中設置了所需的條目，並生成了密鑰並使用一封給自己的單行電子郵件對其進行了測試。
echo "Test message" | mail -s "Test message" fred.bloggs@example.com這應該會從 ubuntu@webhost.example.com 生成一封電子郵件。它確實由 OpenDKIM 正確簽名，並發送到我的 Gmail 帳戶並成功通過驗證。
這是我在 GMail 上得到的：
Delivered-To: fred.bloggs@example.com Received: by 2002:a5d:48c4:0:0:0:0:0 with SMTP id p4csp257074wrs; Tue, 19 Mar 2019 21:00:38 -0700 (PDT) X-Google-Smtp-Source: APXvYqzzFOWDKe9HXwsYXMKgDAYZjyoHVQj0EcFTzj7zrlnhiY0QBCN2DaEXqiXjh8T71ZiLDzqc X-Received: by 2002:a62:5789:: with SMTP id i9mr27645136pfj.75.1553054437831; Tue, 19 Mar 2019 21:00:37 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553054437; cv=none; d=google.com; s=arc-20160816; b=bBqJW5ba0CKQdhBlKSOmx8A+D++aHf/NwbCWSD5V0Mq/+E2NSAwtSU9Yi/sOpp0dAl VZ2fbB1PNjhB1KGTT2vwoOambDbYUwWB2nIMG5w3aFlUVoOFgYLmLFZwHx6EeTm+nKbQ tu6XzdsjT0Vl9HtH44hXed4WU5eRe4KGcblkKSswF3xQ3k57PPOSOea0qdqSN+K3Usj1 yv9B81pxTRKdBa3Ihkxmy6q0BPfiwwVRD1rb22/swhC/QS7O7M/9AKGxlxBhl1zgks9a 55Sm1ghGyN3HFoDlZ8bWNo0qImV4bQPsDaTVDykueHOxC2tXBdxA8559io4QKwBU2yc1 TFFA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=from:date:message-id:to:subject:dkim-signature; bh=vMryiu7Ey0Nro6WC0HJ1+2DMJ4hQ10+LmaSady45MSs=; b=RN6/AsO7ejyBlwkSuPyLIgktIttKp2ar60+D0vyf4Le/RP543qL/OQUSC5su1tbc7l fbEaCSnDuuBpB0OlJiBjQHeu0y3+FvK4cjmElRgPMyMFbk3q6PxbEXLrgeKs9tiKFHSG TFAu+Czb32yhOVgmJQNwQ4cpyOKEZmfz7eXFwXBvw69D4qGUrW6q7j54xoQGl8kTVDM5 kUz/N4JoiS9rAFNxft/fg0druQaoMCFhuPR8d5a7NYJBp3vV+bWyonLD2kGbqxFujU97 RjAMko+eMvuWS7zWOnqYF3Di3MyGDLBlue4+rXz65o0VxrTS/MZhsKZFG/LzlBdi4vPF 0thA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@webhost.example.com header.s=webhost header.b=eMU0P6hB; spf=pass (google.com: domain of ubuntu@webhost.example.com designates 13.238.180.128 as permitted sender) smtp.mailfrom=ubuntu@webhost.example.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=example.com Return-Path: <ubuntu@webhost.example.com> Received: from webhost.example.com (ec2-13-238-180-128.ap-southeast-2.compute.amazonaws.com. [13.238.180.128]) by mx.google.com with ESMTP id j134si770928pgc.42.2019.03.19.21.00.37 for <fred.bloggs@example.com>; Tue, 19 Mar 2019 21:00:37 -0700 (PDT) Received-SPF: pass (google.com: domain of ubuntu@webhost.example.com designates 13.238.180.128 as permitted sender) client-ip=13.238.180.128; Authentication-Results: mx.google.com; dkim=pass header.i=@webhost.example.com header.s=webhost header.b=eMU0P6hB; spf=pass (google.com: domain of ubuntu@webhost.example.com designates 13.238.180.128 as permitted sender) smtp.mailfrom=ubuntu@webhost.example.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=example.com Received: by webhost.example.com (Postfix, from userid 1000) id 3E9A8FA106; Wed, 20 Mar 2019 04:00:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=webhost.example.com; s=webhost; t=1553054436; bh=vMryiu7Ey0Nro6WC0HJ1+2DMJ4hQ10+LmaSady45MSs=; h=Subject:To:Date:From:From; b=eMU0P6hBtTMDVSU5aw1dTR7CSlrBSHjK4And4uaFeo+HnSnD5+bBAKObTk3WxeLgr Tf/1/httpjXNUdphU5STlFSqeunuZJafxDqLVzuoYHJOCuQ8vfGoZqyI2hGaJ9ql8E dSp1j1mOVRBYC8KpSYbnA+Uc2+ut68mQDDRc2pZQWdQLzmxWwCiz+tAAXdHQFVsx+D sobOHN/cq9CgJNkEs0qnjsE9zdnTdMrO+1AbnJBCHKeQBZAoDdg4OjjlMmg4kTmLli fyVtcYBHaY8OjM15qiKL0YvjzfnCP50L7VjT9EBAhtJn2d9lYGyhQ/sLbwx91nL/yG OTxMRE82pD6wQ== Subject: This is a test message To: <fred.bloggs@example.com> X-Mailer: mail (GNU Mailutils 3.4) Message-Id: <20190320040036.3E9A8FA106@webhost.example.com> Date: Wed, 20 Mar 2019 04:00:36 +0000 (UTC) From: Ubuntu <ubuntu@webhost.example.com> This is a test message. You know the drill!到現在為止還挺好。
我設置了我的 cron 作業並添加了該行
MAILTO=fred.bloggs@example.com輸出已生成、簽名並郵寄，但 GMail 未能通過 DKIM 驗證
dkim=neutral (body hash did not verify) header.i=@webhost.example.com header.s=webhost header.b=tXJM8ih0;這是完整的電子郵件。如果它有用，這是 curl 請求的輸出。
Delivered-To: fred.bloggs@example.com Received: by 2002:a5d:48c4:0:0:0:0:0 with SMTP id p4csp776152wrs; Wed, 20 Mar 2019 07:14:04 -0700 (PDT) X-Google-Smtp-Source: APXvYqyZdMJuwpApjkjfxfh/rsHg67hLBtQSS5j0BUCq8NaaxUqV+sIDf7CPy+sYjS2b817v9pAu X-Received: by 2002:a63:5541:: with SMTP id f1mr7627593pgm.38.1553091244323; Wed, 20 Mar 2019 07:14:04 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553091244; cv=none; d=google.com; s=arc-20160816; b=h3SPkfLIm9BjWS+SlJc4Wd/8XFE2YT3QNSOkzzLY858wldyOXMn3OR8rFcU6UVmbEL stCPHuXM7ouP0s7ICTC4TAyv+DiqWNokBsRkwXjdP6+mEEmXlP6VUk8H/+nL89BrMp4E FhzVM4sE5/3VphjuXPom0Ux+e+WrLDWBZbKMbMOLSMkbmCL6B3/llK3FMwPfAGPzS2O8 o+cfm6r15W0aND02eIvNg6px2kNmD+wHAI993/BZJ3vIPvNzsEHFUWwbD10iYkIUwmvA DMUVB3jx+pXtFhv17+Fpx0zsSx5806vieOVoLxXAnlJgdykNH/DuZY3NM1DVyR1Renxw eTPg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=date:message-id:content-transfer-encoding:mime-version:subject:to :from:dkim-signature; bh=lkMik4Dz2hOPxvMLwTHlE8QE1l4G/X7DcjAYikPMEMc=; b=N85+olM3406vk7LhpV03QNxCZQLELh+ZLjUIUg1xt5u7z/aJZS0CRa1q4JJcBn8Fm0 nRBvMLFJXIrm0Y11s5kET6Xvzkk9G/szfJNqthy7e80mHs2Q7xgfYeVpYmQmL3DxjVjm mzlnJVzVyx0XLMcAKaneb0CkOIsuOo6nkCGMakPsS9e+vMpfdnBggZZQv1zqkGHzTnML +QMIVMEH7kgQphYo6GiCVb1LWThuwYyI+nSclPDw9fNLRPGTNqbiBqWQuEdgM3/K46Zy gY4SgTXwL+MOCVgIbN33ZG3FuVHwyr5bQZGrpR48HXS68zYA5jbcgF9eFDBtuBOQPDo+ HkKw== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@webhost.example.com header.s=webhost header.b=tXJM8ih0; spf=pass (google.com: domain of ubuntu@webhost.example.com designates 13.238.180.128 as permitted sender) smtp.mailfrom=ubuntu@webhost.example.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=example.com Return-Path: <ubuntu@webhost.example.com> Received: from webhost.example.com (ec2-13-238-180-128.ap-southeast-2.compute.amazonaws.com. [13.238.180.128]) by mx.google.com with ESMTP id b7si1705816pgl.20.2019.03.20.07.14.03 for <fred.bloggs@example.com>; Wed, 20 Mar 2019 07:14:04 -0700 (PDT) Received-SPF: pass (google.com: domain of ubuntu@webhost.example.com designates 13.238.180.128 as permitted sender) client-ip=13.238.180.128; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@webhost.example.com header.s=webhost header.b=tXJM8ih0; spf=pass (google.com: domain of ubuntu@webhost.example.com designates 13.238.180.128 as permitted sender) smtp.mailfrom=ubuntu@webhost.example.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=example.com Received: by webhost.example.com (Postfix, from userid 1000) id 0FACCFA104; Wed, 20 Mar 2019 14:14:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=webhost.example.com; s=webhost; t=1553091242; bh=20rEKrmO1yPqlIJwX4HLsjr/kx4SaM/AaK17/OmPhLA=; h=From:To:Subject:Date:From; b=tXJM8ih006AjxwXJNAD30k7Fjo/HYTsi5bEfOCaxr0D8BiEAA/mIiDvaexjHPWNQ6 B5DrCGlhvLVZIRs1Zp2v4pbYYYvpmrzOTB99vXk0lEEGTRIwdhvAYKT31Jt2N5VMq3 hifps7hj3TD/Eevks82VvcIu2xJWXFPNEZMGvjcRa3hFSE2IIcfOhMJhwX5Rcnx+F4 wjtxqROgxXpHxgJkXzkVe3HbpKVK5eOrsBoeRnUhR4SWa2f7UKhT4k28KOuTQo8bG3 E63PoPwcOQU4cPiiqnPEdWO7ERvSHetgh/1yjpigcbch9SWwQHwA4FPSmcfOfLeIov +wxrbVKHXtzMA== From: root@webhost.example.com (Cron Daemon) To: fred.bloggs@example.com Subject: Cron <ubuntu@webhost> curl https://invoicing2018.example.com/tasks/run MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Cron-Env: <MAILTO=fred.bloggs@example.com> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/home/ubuntu> X-Cron-Env: <PATH=/usr/bin:/bin> X-Cron-Env: <LOGNAME=ubuntu> Message-Id: <20190320141402.0FACCFA104@webhost.example.com> Date: Wed, 20 Mar 2019 14:14:02 +0000 (UTC) % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0來自 cron 的電子郵件也以同樣的方式使Port25 驗證程序失敗
所以，問題是：
為什麼我的 DKIM 配置正確簽署了除 CRON 輸出之外的所有內容？
我能做些什麼來解決這個問題？
我可以嘗試使用腳本來執行curl請求並使用 mail 發送電子郵件，但我還有許多其他 cron 作業要添加，我寧願在嘗試解決方法之前解決潛在問題。
mx.google.com 完成的身份驗證結果表明，您在命令行上發送的消息與通過 cron 作業發送的消息之間的相應正文中存在一些不同：“正文雜湊未驗證”。
OpenDKIM 的一個常見問題是不規則的行尾。RFC 5322 聲明“CR 和 LF 只能作為 CRLF 一起出現；它們不能在正文中獨立出現。” 因此，您手動發送的消息可能具有正確的行尾，但由 cron 作業發送的消息卻沒有。您可以嘗試在 OpenDKIM 的配置中設置“FixCRLF yes”。
不管這是否是原因，您可以在 OpenDKIM 中啟用“KeepTemporaryFiles”：“指示過濾器創建臨時文件，其中包含已簽名或驗證的消息的標頭和正文規範化。可以使用 TemporaryDirectory 參數設置這些文件的位置. 僅用於調試驗證問題。這樣，您可以比較原始正文和傳遞到 GMail 的正文，並可能找出導致驗證錯誤的差異。