dkim=permerror

OpenDKIM writes a bare `dkim=permerror` without a reason (reproduced with signatures lacking `bh=`, with `v=2`, with an unknown `a=` and with `i=` outside `d=`). mailauth reports syntax problems as `dkim=neutral` with a comment naming the problem, falling back to "signature syntax error".

What it means

The DKIM signature could not be evaluated at all, and retrying will not help: the `DKIM-Signature` header is syntactically broken or violates the rules of RFC 6376 (a required tag such as `bh=` or `b=` missing, an unknown version, an unsupported algorithm, an `i=` identity outside the `d=` domain, `From` not among the signed headers), or the public key record is unusable. RFC 8601 calls this a permanent error. For DMARC it is not a pass.

Why it happens

• Malformed or truncated DKIM-Signature

  common

  Home-made signing code that omits tags, relays that fold or truncate long headers incorrectly, or a signature header damaged by a mail client that re-encoded it.

• Algorithm the verifier does not support

  occasional

  `a=rsa-sha1` (deprecated by RFC 8301) or `ed25519-sha256` at an older receiver. Signing with both RSA-SHA256 and Ed25519 covers every receiver.

• i= outside the signing domain

  occasional

  The agent identifier `i=` must be in `d=` or a subdomain of it. `d=example.com; i=@example.org` is invalid.

• The From header is not signed

  occasional

  RFC 6376 requires `From` in `h=`. A signer configured with a custom header list that leaves it out produces signatures receivers reject.

How to fix it

1. 1.

   List the signature's tags

   Unfold the header and check the required tags and their values; the DKIM debugger does this and names the offending tag.

   # Show the DKIM-Signature as one line and list its tags
   awk '/^DKIM-Signature:/{p=1} p&&/^[^ \t]/&&!/^DKIM-Signature:/{p=0} p' message.eml | tr -d '\r\n\t' | tr ';' '\n'
   # required: v=1 a= b= bh= d= h= (containing "from") s=

2. 2.

   Use a standard signer configuration

   RSA-SHA256 (optionally plus Ed25519), `From` signed (and oversigned), and a maintained signing implementation instead of custom code.

   # OpenDKIM signer: standard algorithm, From always signed
   SignatureAlgorithm  rsa-sha256
   OversignHeaders     From
   Canonicalization    relaxed/simple

← Browse the full signature error database