Sophos UTM, DKIM and Microsoft-hosted email servers

Hello Ifor Davies,

Thank you for reaching out to the community, you can configure DKIM on Sophos UTM SMTP proxy using this KBA:
> Sophos UTM: DomainKeys DKIM setup guide - https://support.sophos.com/support/s/article/KB-000034259?language=en_US
> Sophos UTM: DKIM setup using Windows OpenSSL - https://support.sophos.com/support/s/article/KB-000034335?language=en_US

Hello Vivek

Thanks for replying: I actually followed the instructions in your first link when I initially set up DKIM signing. I've investigated further and I think I've found the cause of the issue.

If the system that creates the email does not add a Message-ID header, then Microsoft adds its own. It then proceeds to use this header in its DKIM validation check - even though the header was not in the original email - and so validation fails. (There are other mail systems, e.g. Gmail, that will add their own Message-ID header, but I think they are clever enough not to use it when verifying DKIM.)

One fix would be to remove Message-ID from the list of headers in the DKIM signature, so it is ignored and doesn't form part of the validation calculation, but there doesn't seem to be a way to do this in Webadmin. I suppose I'll need to ask our development team to tweak their code...

Hello Vivek

Thanks for replying: I actually followed the instructions in your first link when I initially set up DKIM signing. I've investigated further and I think I've found the cause of the issue.

If the system that creates the email does not add a Message-ID header, then Microsoft adds its own. It then proceeds to use this header in its DKIM validation check - even though the header was not in the original email - and so validation fails. (There are other mail systems, e.g. Gmail, that will add their own Message-ID header, but I think they are clever enough not to use it when verifying DKIM.)

One fix would be to remove Message-ID from the list of headers in the DKIM signature, so it is ignored and doesn't form part of the validation calculation, but there doesn't seem to be a way to do this in Webadmin. I suppose I'll need to ask our development team to tweak their code...