DKIM signing performs conversion to 7-bit

[breedbekkikker]

The DKIM Sign function performs a 7-bit MIME conversion of the message body before calculating the body hash. DKIM RFC states that such a conversion "is outside the scope of DKIM". This conversion breaks any already signed 8-bit MIME messages (or, depending on how MimeKit is used in the custom implementation, in an incorrect body hash).

I would suggest to remove the 7-bit conversion from the DKIM Sign function or to make it optional when calling the Sign function.

[jstedfast]

So the reason that I did that was because before you can send via SMTP, you will need to force the message into the 7bit or 8bit encoding, depending on what the server supports/requires (e.g. an SMTP server that does not support the 8BITMIME extension will require that messages be in the 7bit encoding).

By forcing it into the 7bit encoding, it is safe for either.

This is the strategy used by S/MIME and OpenPGP as well.

You might say, "but Jeff, what if we know that my SMTP server supports 8BITMIME? Why force it into 7bit?"

Here's the problem with that: Your SMTP server is not the final destination for most of the email you send (in general). So while your SMTP server may support 8BITMIME, the destination SMTP server might not, which means that your SMTP server will be forced to re-encode the message before passing it along to the next SMTP server. If the message was cryptographically signed while the message was in the 8bit encoding, then it will no longer verify in that case.

Now... that said, the scenario you describe is also valid and one that I regrettably did not foresee because I was probably a bit too myopic in my estimation of how MimeKit's DKIM signing logic would be used (which is to say that I had assumed it would only be used by the originator and not somewhere along the transport route).

[breedbekkikker]

I completely agree with your comment. Additionally, if the destination SMTP server does not support 8BITMIME, RFC also allows to not deliver the message and send an NDR to the sender. I would opt to not convert to 7-bit encoding to not break signed messages.

Thanks again for your prompt response and fix!