DKIM uses length field while discouraged by RFC

[KlaasBonnema]

PHPMailer 6.1.4 always includes the length field l= in a DKIM key. RFC 5672 section 3.5 discourages using the length field because it opens possible attack vectors. Since it is an optional field anyway it should be left out of the DKIM key.

[Synchro]

That sounds reasonable. Care to make a PR?

[KlaasBonnema]

Marcus, What's a PR? Klaas

…

________________________________ Van: Marcus Bointon <notifications@github.com> Verzonden: vrijdag 14 februari 2020 15:59 Aan: PHPMailer/PHPMailer <PHPMailer@noreply.github.com> CC: KlaasBonnema <kljbonnema@hotmail.com>; Author <author@noreply.github.com> Onderwerp: Re: [PHPMailer/PHPMailer] DKIM uses length field while discouraged by RFC (#1964) That sounds reasonable. Care to make a PR? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub<#1964?email_source=notifications&email_token=AGABOGU37SLKMDN254CIKJTRC2WV7A5CNFSM4KVJFWSKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOELZJSMQ#issuecomment-586324274>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AGABOGVSQC4E22JG66VBRBLRC2WV7ANCNFSM4KVJFWSA>.

[Synchro]

Ah, you're new here! A PR is a pull request – fork the project, make the changes necessary to implement what you propose (ideally with accompanying tests), then request that it be merged back into this project. It sounds like you know what you're doing with DKIM - please take a look at my DKIM validator project too.

[KlaasBonnema]

I'll have to look into that. My immediate issue is with static::$LE and DKIM. It blocks migration to PHPMailer. I currently use DKIM Validator plugin in Thunderbird and check-auth@validator.port25.com for DKIM validations. Is a PR for one issue only or could I combine several issues?

[Synchro]

Generally it's a good idea to keep them separate as it keeps things on-topic for each one. The advantage of the validator being in PHP is that it can be used from within a closed and automated test environment and doesn't need any other tools.

Regarding the LE thing, generally I'd recommend avoiding using mail() as a sending mechanism at all. It's got inherent security holes, and it's slower than using SMTP to localhost. As a secondary effect, it also means you never need to use LF line breaks.