An edge case that causes DKIM verification failure is when the email comes from a private relay service or a transfer agent. These intermediaries modify the body without updating the expected hash in the header.
One specific example is if Apple users select to "sign-in with Apple ID" for certain apps (i.e. Yelp), Apple will relay the email from Yelp to the receiver all under emails hosted by privaterelay.appleid.com. Even though the signature passes, the body hash check fails.
const dkimResult = await dkimVerify(rawEmail);
console.log(dkimResult)spits out the following error:
{
headerFrom: [
'no-reply_at_mail_yelp_com_xdv2qypf6k_d3e906cd@privaterelay.appleid.com'
],
envelopeFrom: 'privaterelay.bounce.xdv2qypf6k@privaterelay.appleid.com',
results: [
{
signingDomain: 'privaterelay.appleid.com',
selector: 'prv2019',
// abbreviated
bodyHash: 'y/pRNiQ3oAGue/rXnUlbK8RE5WJKj5yqLqfVTXbD9vQ=',
bodyHashExpecting: 'hf7kLUsqHDsk69NP7DoTs/lTLUh4F88Ec0c3kQ42a3k=',
// abbreviated
info: 'dkim=neutral (body hash did not verify) header.i=@privaterelay.appleid.com header.s=prv2019 header.a=rsa-sha256 header.b=XjoKCxjS'
}
]
}One way to fix this is to skip the body hash check entirely if we detect that the email is coming from a whitelisted relay service. Or one can check exactly where Apple is tempering with the body and excise that section to get the body hash.
An edge case that causes DKIM verification failure is when the email comes from a private relay service or a transfer agent. These intermediaries modify the body without updating the expected hash in the header.
One specific example is if Apple users select to "sign-in with Apple ID" for certain apps (i.e. Yelp), Apple will relay the email from Yelp to the receiver all under emails hosted by privaterelay.appleid.com. Even though the signature passes, the body hash check fails.
spits out the following error:
One way to fix this is to skip the body hash check entirely if we detect that the email is coming from a whitelisted relay service. Or one can check exactly where Apple is tempering with the body and excise that section to get the body hash.