Issue Change DKIM Signature mail headers

[vargasia]

Server operating system version

Debian 12

Plesk version and microupdate number

18.0.71 #4

Hi there.

I noticed an issue with the DKIM signature Plesk generates.

The DKIM-Signature header includes this:
h=Received:Received:From:To:Subject;

Two problems here:

1. The Received header is repeated twice.
2. Important headers like Date, Message-ID, and MIME-Version are completely missing from the signed headers list.

This weakens the DKIM signature and causes Hotmail/Outlook to reject or mark the DKIM as invalid, even though other providers accept it fine.

I suspect Plesk’s DKIM signing component is not properly configuring which headers to sign, or there’s a bug causing header duplication and omission.

Can someone confirm this is a known issue? Is there a fix or a way to customize which headers get signed in Plesk’s DKIM?

Thanks in advance.

 

[burnley]

@Sebahat.hadzhi Is there a way to customise what fileds are DKIM signed in the email headers, either via a configuration file or panel.ini entry perhaps? By default Plesk seems to use a minimal set h=From:To:Subject; and possibly Recieved. We see that Plesk has its own internal DKIM signing milter for this but there appears to be no relevant documentation on how to adjust it.

This been raised by several clients now as a result of security audits so we are investigating what can be done to tighten security.

 

[nmdpa3]

There have been numerous changes to DKIM since 18.0.71 #4 - https://docs.plesk.com/release-notes/obsidian/change-log/

 

[Sebahat.hadzhi]

@burnley , the list of the headers that are included into DKIM signature when Plesk is signing outgoing emails is hardcoded into the dk_sign utility and cannot be changed at present.

 

[burnley]

hmm, ok thanks for confirming. Hopefully it is something that will be addressed before it becomes part of an AI attack vector using the email header fields that are not signed. Giving admins the ability to configure this and thus choose their own risk profile seems like an easy solution and I do appreciate why you would have such a conservative base selection.

 

[LRLD]

or there’s a bug causing header duplication and omission.

No, it's not a bug, it's by design.
When you install the standard OpenDKIM package from Ubuntu, you have the following option in /etc/opendkim.conf...

OversignHeaders        From

Which results in From being signed twice and showing in the header twice. The default "From" may have changed since I last installed it.

It would be nice to have more control over things like this.

I hope that answers your question.

Regards

LD