hmLoadTopic({
hmKeywords:"Canonicalization,DKIM,DKIM Canonicalization,DKIM Options,DKIM Signature tags,DKIM tags,Tags,Tags DKIM",
hmTitle:"DKIM Settings",
hmDescription:"DKIM Signing Settings Signatures expire after [XX] days (\"x=\" tag, 7 days recommended) If you wish to limit the number of days that a DKIM signature can be considered valid, ac",
hmPrevLink:"security--dkim_sign.html",
hmNextLink:"security--dmarc.html",
hmParentLink:"security--domainkeys_identified_mail.html",
hmBreadCrumbs:"<a href=\"security_menu.html\">Security Menu<\/a> &gt; Security Manager &gt; Sender Authentication &gt; <a href=\"security--domainkeys_identified_mail.html\">DomainKeys Identified Mail<\/a>",
hmTitlePath:"Security Menu > Security Manager > Sender Authentication > DomainKeys Identified Mail > DKIM Settings",
hmHeader:"<h1 class=\"p_Heading1\" style=\"page-break-after: avoid;\"><span class=\"f_Heading1\">DKIM Settings<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_BodyText_Center\"><img style=\"margin:0 auto 0 auto;width:32.5625rem;height:26.9375rem;border:none\" src=\".\/images\/sender-authentication_dkim-settings.png\"\/><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">DKIM Signing Settings<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Signatures expire after [XX] days (&quot;x=&quot; tag, 7 days recommended)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">If you wish to limit the number of days that a DKIM signature can be considered valid, activate this option and specify the desired number of days. Messages with expired signatures will always fail verification. This option corresponds to the signature\'s &quot;<\/span><span class=\"f_T_Code\">x=<\/span><span class=\"f_ControlIndent\">&quot; tag. This option is enabled by default, with the value set to 7 days.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Signatures include creation time stamp (include t= tag)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">When this option is enabled, the signature creation time stamp (&quot;t=&quot; tag) will be included in the signature. This is enabled by default.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Signatures include query method(s) (include q= tag)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">By default this option is enabled. It causes the signature to include the query method tag (e.g. &quot;q=dns&quot;).<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Signatures include body length count (include l= tag)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Enable this option if you wish to include the body length count tag in DKIM signatures.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Signatures include original header content (include z= tag)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this option if you wish to include the &quot;z=&quot; tag in the DKIM signature. This tag will contain a copy of the message<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif; color: #010100;\">\'<\/span><span class=\"f_ControlIndent\">s original headers. This can potentially make signatures quite large.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Signatures include reporting requested (include r=y tag)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Enable this option if you wish include the r=y tag in your signed messages. The presence of this tag indicates to receiving servers who honor the tag that you wish to receive AFRF failure reports from them when they encounter messages purporting to be from your domain but fail DKIM verification. To receive these reports, however, you must also configure a DKIM reporting TXT record in your domain\'s DNS<\/span><span class=\"f_ControlIndent\">. See RFC-6651: <\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\"><a href=\"http:\/\/tools.ietf.org\/html\/rfc6651\" target=\"_blank\" class=\"weblink\">Extensions to DomainKeys Identified Mail (DKIM) for Failure Reporting<\/a><\/span><span class=\"f_ControlIndent\">, for syntax and instructions on how to do that. Since this option requires DNS changes, it is disabled by default.<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Canonicalization <\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Canonicalization is a process whereby the message<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif; color: #010100;\">\'<\/span><span class=\"f_ControlIndent\">s headers and body are converted into a canonical standard and &quot;normalized&quot; before the DKIM signature is created. This is necessary because some email servers and relay systems will make various inconsequential changes to the message during normal processing, which could otherwise break the signature if a canonical standard was not used to prepare each message for signing. Currently there are two canonicalization methods used for DKIM signing and verification: Simple and Relaxed. Simple is the strictest method, allowing little to no changes to the message. Relaxed is more forgiving than Simple, allowing several inconsequential changes.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Canonicalize headers using: Simple, Relaxed<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">This is the canonicalization method used for the message headers when signing the message. Simple allows no changes to the header fields in any way. Relaxed allows for converting header names (not header values) to lower case, converting one or more sequential spaces to a single space, and other innocuous changes. The default setting is &quot;Simple.&quot;<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Canonicalize body using: Simple, Relaxed<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">This is the canonicalization method used for the message body when signing the message. Simple ignores empty lines at the end of the message body—no other changes to the body are allowed. Relaxed allows for blank lines at the end of the message, ignores spaces at the end of lines, reduces all sequences of spaces in a single line to a single space character, and other minor changes. The default setting is &quot;Simple.&quot;<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">DKIM Verification Settings<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Verifier honors body length count (l= tag)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">When this option is enabled, MDaemon will honor the body length count tag when it is found in an incoming message<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif; color: #010100;\">\'<\/span><span class=\"f_ControlIndent\">s DKIM signature. When the actual body length count is greater than the value contained in this tag, MDaemon will only verify the amount specified in the tag — the remainder of the message will remain unverified. This indicates that something was appended to the message, and consequently that unverified portion could be considered suspect. When the actual body length count is less than the value contained in this tag, the signature will not pass verification (i.e. it will receive a &quot;<\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">FAIL<\/span><span class=\"f_ControlIndent\">&quot; result). This indicates that some portion of the message was deleted, causing the body length count to be less than the amount specified in the tag.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Verifier requires signatures to protect the Subject header<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Enable this option if you wish to require the DKIM signature of incoming messages to protect the Subject header.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Valid signatures from \'Approved List\' domains add this to Spam Filter score:<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">The value specified here will be added to the Spam Filter score of any DKIM signed messages that receive a &quot;Pass&quot; result when the domain taken from the signature appears on the <a href=\"security--approved_list.html\" class=\"topiclink\">Approved List<\/a>. When a message’s signature is verified but the domain is not on the Approved List, the Spam Filter score will not be adjusted—the verified signature will have no effect on the score. However, normal Spam Filter processing and scoring will still be applied to that message.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/lightbulb_on_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">Ordinarily the value specified here should be a negative number so that the spam score will be reduced for messages containing a valid cryptographic signature when the domain taken from the signature is on the <a href=\"security--approved_list.html\" class=\"topiclink\">Approved List<\/a>. MDaemon’s default value for this option is <\/span><span class=\"f_T_Code\">-0.5<\/span><span class=\"f_Notes\">.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_SeeAlso\" style=\"page-break-after: avoid; border-right: none; border-bottom: none; border-left: none;\"><span class=\"f_SeeAlso\">See:<\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"security--domainkeys_identified_mail.html\" class=\"topiclink\">DomainKeys Identified Mail<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"security--dkim_verify.html\" class=\"topiclink\">DKIM Verification<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"security--dkim_sign.html\" class=\"topiclink\">DKIM Signing<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\">&nbsp;<\/span><\/p>\n\r"
})
