Matt Corallo:
> When debugging a DKIM signature failure, I found that:
>
> * Thunderbird doesn't care at all about the SMTP line length limit, happily
> sending longer lines
> when you quote a 1000-charachter line,
> * Postfix happily accepts the too-long-line, passing it as-is to opendkim
> * opendkim is unmaintained and doesn't care either, signing the too-long
> line,
> * Postfix (and other MTAs downstream too, probably) will truncate the line
> as documented, breaking
> the DKIM signature.
Indeed, Thunderbird sends SMTP mail that violates the SMTP spec,
and that is the real problem. The Postfix SMTP client breaks long
lines for SMTP protocol compliance, but other Postfix delivery
agents do not (because they aren't bound by the rules of SMTP).
I'm sure that the DKIM spec has guidelines for how to make signature
breakage less likely, including a recommendation to avoid sending
send non-compliant messages.
Wietse
