cloudflare / dkim

DKIM (RFC6376) implementation

cfdkim

DKIM (RFC6376) implementation

Features

Verifying email signatures

Example:

let res: DKIMResult = cfdkim::verify_email(&logger, &from_domain, &parsed_email).await?;

if let Some(err) = &res.error() {
  error!(logger, "dkim verify fail: {}", err);
}

println!("dkim={}", res.with_detail());

The verify_email arguments are the following:

• logger: slog::Logger
• from_domain: &str (RFC5322.From's domain)
• parsed_email: mailparse::ParsedMail

Signing an email

Example:

let private_key =
    rsa::RsaPrivateKey::read_pkcs1_pem_file(Path::new("./test/keys/2022.private"))?;

let signer = SignerBuilder::new()
    .with_signed_headers(&["From", "Subject"])?
    .with_private_key(private_key)
    .with_selector("2020")
    .with_logger(&logger)
    .with_signing_domain("example.com")
    .build()?;
let signature = signer.sign(&email)?;

println!("{}", signature); // DKIM-Signature: ...

See the SignerBuilder object documentation for more information.

Generate a test DKIM key

Using OpenDKIM:

opendkim-genkey \
    --testmode \
    --domain=example.com \
    --selector=2022 \
    --nosubdomains

dkim's Issues

Using with tracing-rs?

Hi :)

I wanted to consider using this for my wip rust mail server. It uses the nowadays fairly common tracing crate for logging. However, this crate seems to require a slog logger.

Is there any chance to solve this requirement differently to allow usage with other logging implementations like tracing?

get_body() is not robust to LF line endings

Current code of get_body expects that body starts after <CR><LF><CR><LF>:

dkim/src/hash.rs

Line 23 in b50a082

Ok(bytes::get_all_after(email.raw_bytes, b"\r\n\r\n").to_vec())

This code does not work for mails extracted from Dovecot Maildir which have LF line endings.

mailparse already splits headers and body in a different way inside parse_headers function:
https://github.com/staktrace/mailparse/blob/c51e92416c193072c739035fdcd5501c15f690e4/src/lib.rs#L939C1-L952C7

I managed to verify signatures of mails from Maildir, but had to do .replace("\n", "\r\n").

It would be nice to reuse mailparse splitting instead of splitting in a non-robust way. mailparse currently does not expose body_bytes (and header_bytes) fields, but proposing this to https://github.com/staktrace/mailparse/ is easy as it is well-maintained.

Version 0.3.0 is on crates.io but not on GitHub