Changes for version 0.26 - 2026-10-20
- The Message-Instances are verified before the signatures, and a message in a file can be signed and gated without reading it into memory. No change to anything on the wire; which error is primary changes for messages with more than one fault.
- New Mail::DKIM2::BodyHasher: the body hash body_digest_raw gives, from a message fed through PRINT/CLOSE or load() in pieces, holding at most a megabyte of the body. Its body_hashes are what calculate's BodyHash and verify's BodyHashes take, so a Message-Instance can be computed or checked from the header block alone.
- Verifier order: the Message-Instances are checked first (each one's content, then the walk, section 14.7), the signatures second (sections 14.2 to 14.6), From last. No key is needed to refuse a message whose instances do not describe it, and with several faults a hash mismatch is now the primary error over a timestamp, custody, key or signature error.
- Under AllowUnsignedMI or MidProcess, Message-Instances with no DKIM2-Signature are walked: 'none' if they match the message, the walk's fail or permerror if not (it was 'none' unread).
- New Verifier option InstancesOnly (instances_only): the chain's shape and the Message-Instances, then stop, with no key fetched; 'pass' ("Message-Instance m=1..N intact") when they match.
- Gate->check takes a filehandle (or any object with getline) as well as a string, and streams its body into the Verifier. The chain is walked once, always by the Verifier (InstancesOnly with no signature or with VerifyResult); it no longer calls MessageInstance->chain_verifies.
- The Signer discards the body as it arrives (section 12.8 signs none of it), and may be fed the header block alone.
- load() reads a filehandle a piece at a time, and stops reading once the parser has stopped (a Verifier with no signature to check, after the header fields), instead of reading it whole.
Documentation
Standalone DKIM2 milter for Postfix
Modules
DKIM2 signing and verification for email
the body hash of a message, streamed
every Message-Instance's body hash in one pass
Canonicalization, hashing, folding and key handling for DKIM2
DKIM2-signed Delivery Status Notifications
SHA-2 over message content, by OpenSSL where it can
decide whether a front end may sign a message
Streaming message parser base for Signer and Verifier
every Message-Instance's header hash without undo
Compute, verify and undo Message-Instance headers
Keep message snapshots keyed by Message-Instance
verify-and-reflect DKIM2 demonstration logic for dkim2.com
One DKIM2-Signature header, parsed or under construction
Sign a message with a DKIM2-Signature header
Bcc-safe recipient grouping before DKIM2 signing
The tag=value list a DKIM2 header is made of
structured per-level DKIM2 and Message-Instance report
Verify the DKIM2-Signature chain on a message
wrap a single-part message in a one-part multipart/mixed
Handler class for DKIM2 signing
Handler class for DKIM2 signature verification