Issue Multiple DKIM headers added when having multiple BCC addresses

[Tozz]

We are receiving complaints about users' e-mail getting rejected due to 'Headers too large'. We did some testing and noticed when when e-mail is send using webmail (Roundcube) (possibly also SMTP, did not test) DKIM headers are added to each mail multipled by the number of BCC addresses.

So, if you send an e-mail with 10 people in BCC, 10 DKIM headers are added.

Sample headers are:

Authentication-Results: callisto.exsilia.net;
        dkim=pass (good signature) [email protected]
Return-Path: <[email protected]>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on callisto.exsilia.net
X-Spam-Level:
X-Spam-Status: No, score=0.0 required=5.0 tests=LOCALPART_IN_SUBJECT,
        RCVD_IN_DNSWL_LOW,SPF_PASS,T_DKIM_INVALID autolearn=unavailable
        autolearn_force=no version=3.4.0
X-Spam-Report:
        * -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low
        *      trust
        *      [83.137.145.12 listed in list.dnswl.org]
        *  0.7 LOCALPART_IN_SUBJECT Local part of To: address appears in Subject
        * -0.0 SPF_PASS SPF: sender matches SPF record
        *  0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
X-Original-To: X
Delivered-To: X
Received: from neptune.exsilia.net (neptune.exsilia.net [83.137.145.12])
        by callisto.exsilia.net (Postfix) with ESMTPS id 506D3216450B
        for <X>; Fri, 17 Mar 2017 15:05:19 +0100 (CET)
Received-SPF: pass (callisto.exsilia.net: domain of X.nl designates 83.137.145.12 as permitted sender) client-ip=83.137.145.12; [email protected]; helo=neptune.exsilia.net;
Received: from webmail.X.nl (localhost [IPv6:::1])
        by neptune.exsilia.net (Postfix) with ESMTPA id E3FE12DD1DD1;
        Fri, 17 Mar 2017 15:05:18 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=X.nl;
        s=default; t=1489759519;
        bh=r65XYbi3uvWe7xwip78W0aTrICLQjz1ZtPDsHjCH5jc=; l=55;
        h=From:To:Subject;
        b=hG1md60NmvvF1YHSrNE0lkY/y05gjnzs8Q8cEU9qMoJMdOq7DvwSALKQbGIw8Cyid
         Psm2k6Shj6rlzAauuMRkNDJeZtLomXIe4dndo1VtyS32NQgmA18vWA18aiWwCUM1iK
         rytxju+EGSfiP3g8a2XiRjZf2EoWgCkRsoYaiwxM=
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=X.nl;
        s=default; t=1489759519;
        bh=r65XYbi3uvWe7xwip78W0aTrICLQjz1ZtPDsHjCH5jc=; l=55;
        h=From:To:Subject;
        b=hG1md60NmvvF1YHSrNE0lkY/y05gjnzs8Q8cEU9qMoJMdOq7DvwSALKQbGIw8Cyid
         Psm2k6Shj6rlzAauuMRkNDJeZtLomXIe4dndo1VtyS32NQgmA18vWA18aiWwCUM1iK
         rytxju+EGSfiP3g8a2XiRjZf2EoWgCkRsoYaiwxM=
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=X.nl;
        s=default; t=1489759519;
        bh=r65XYbi3uvWe7xwip78W0aTrICLQjz1ZtPDsHjCH5jc=; l=55;
        h=From:To:Subject;
        b=hG1md60NmvvF1YHSrNE0lkY/y05gjnzs8Q8cEU9qMoJMdOq7DvwSALKQbGIw8Cyid
         Psm2k6Shj6rlzAauuMRkNDJeZtLomXIe4dndo1VtyS32NQgmA18vWA18aiWwCUM1iK
         rytxju+EGSfiP3g8a2XiRjZf2EoWgCkRsoYaiwxM=
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=X.nl;
        s=default; t=1489759519;
        bh=r65XYbi3uvWe7xwip78W0aTrICLQjz1ZtPDsHjCH5jc=; l=55;
        h=From:To:Subject;
        b=hG1md60NmvvF1YHSrNE0lkY/y05gjnzs8Q8cEU9qMoJMdOq7DvwSALKQbGIw8Cyid
         Psm2k6Shj6rlzAauuMRkNDJeZtLomXIe4dndo1VtyS32NQgmA18vWA18aiWwCUM1iK
         rytxju+EGSfiP3g8a2XiRjZf2EoWgCkRsoYaiwxM=
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=X.nl;
        s=default; t=1489759518;
        bh=r65XYbi3uvWe7xwip78W0aTrICLQjz1ZtPDsHjCH5jc=; l=55;
        h=From:To:Subject;
        b=OSildAzqcVLQGoxoTsFbxtSAu+01LCGH89LzSnKTs9Td+fV8BpeX9TpOkoqCp1l+V
         tmEJcibXrlbOyQAnJWLzRrVCLsV9AdFMzWT8XqFzy6GfAxZpJo0+ZiCuuDDy260HK0
         UiouM6afyuhb+DKchsnu/R1e91pmhW67KHha6TtM=
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=X.nl;
        s=default; t=1489759518;
        bh=r65XYbi3uvWe7xwip78W0aTrICLQjz1ZtPDsHjCH5jc=; l=55;
        h=From:To:Subject;
        b=OSildAzqcVLQGoxoTsFbxtSAu+01LCGH89LzSnKTs9Td+fV8BpeX9TpOkoqCp1l+V
         tmEJcibXrlbOyQAnJWLzRrVCLsV9AdFMzWT8XqFzy6GfAxZpJo0+ZiCuuDDy260HK0
         UiouM6afyuhb+DKchsnu/R1e91pmhW67KHha6TtM=
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII;
 format=flowed
Content-Transfer-Encoding: 7bit
Date: Fri, 17 Mar 2017 15:05:18 +0100
From: [email protected]
To: [email protected]
Subject: Test
Message-ID: <[email protected]>
X-Sender: [email protected]
User-Agent: Roundcube Webmail/1.2.2

I believe this is a bug in Plesk. Can anyone confirm?

 

[IgorG]

Discussed here https://talk.plesk.com/threads/315-duplicate-dkim-signatures-in-one-email-header.340713/