Forum notification emails fail DKIM: stray quotes in the mail._domainkey TXT record

meta
1

Hi,

Small heads-up: notification emails from this forum arrive with dkim=fail. Gmail shows DKIM fail for the forum’s signature (selector mail), while SPF passes and DMARC passes (p=QUARANTINE), so mail still gets delivered thanks to aligned SPF.

The cause seems to be the DKIM public key in DNS. The mail._domainkey TXT record of the project’s main domain (served by the registrar’s nameservers) contains literal quote characters in the middle of the base64 key:

"v=DKIM1; k=rsa; s=email; p=MIIBIjANBgkq…G8DMG" "\" \"XZbjXGdr+W7OK04…IDAQAB"

Note the \" \" at the start of the second string: the quotes became part of the key data. The mail._domainkey record of the forum subdomain returns the same broken value.

The same key in the occams zone (served by the box itself) is correct:

"v=DKIM1; k=rsa; s=email; p=MIIBIjANBgkq…G8DMG" "XZbjXGdr+W7OK04…IDAQAB"

It looks like the split value from the box’s DNS page was pasted into the registrar’s DNS panel together with the " " separator. Removing the " " (or pasting the key as one continuous string and letting the panel split it) should fix it.

Thanks for the project and the forum!

2

Thanks! I think fixed now.

Some time ago the domain was hit by a DDOS attack (though I doubt we were the target) and I switched from my box itself hosting the domain to a more robust DNS provider, and I guess I didn’t copy the records correctly or maybe I pasted from a zone file and it wasn’t imported correctly. :expressionless:

2 Likes
3

Confirmed - your reply arrived with dkim=pass (d=discourse.mailinabox.email, s=mail) and DMARC pass. Thanks for the quick fix!

And thanks for Mail-in-a-Box in general. I run it for a couple of my own domains and it’s been remarkably low-maintenance; the Status Checks page alone has saved me from several DNS mistakes of exactly this kind.

1 Like
4

Appreciated! Thanks!

2 Likes