fix(dkim): N+1 oversign present headers to detect prepended duplicates

[jiashuoz]

Summary

Listing each present header once in h= leaves header-duplication spoofing open. A DKIM verifier binds listed header instances from the bottom up, so a hop that prepends a second Subject still matches the original and reports pass — while the recipient's MUA displays the attacker's copy at the top.

Present headers are now listed n+1 times. The extra entry asserts "there is no further instance."

Raised during adversarial review of #746, which correctly noted the weakness predates that PR — the old static list also passed each candidate once.

Confirmed both ways against the signer

Not argued from the RFC — measured:

h= listing	Prepended spoof Subject: YOU HAVE WON
From:Subject (before)	verifies clean — spoof succeeds
From:From:Subject:Subject (after)	fails — spoof detected

Same result for From, To, Reply-To, and Message-ID.

Mutation-verified in reverse too: reverting to single listing fails TestSign_PrependedDuplicateHeaderIsDetected with "a prepended duplicate Subject went undetected" on every case.

This must not undo #746

The two interact directly, so there's a dedicated test for it. Absent candidates are still omitted from h= entirely — that's what keeps SES stamping its own Message-ID from breaking the signature. N+1 applies only to headers the message actually carries.

TestSign_NPlusOneDoesNotResurrectOversigning asserts the composer-shaped message still verifies after SES adds Message-ID, so this hardening cannot silently reintroduce the bug it builds on.

Trade-off

A relay that legitimately adds a duplicate of a header we already set would now break the signature. Accepted: no relay in this path does so, and the candidate list is narrow. The alternative is silently accepting a spoofed display value, which is the worse failure — a signature that says "verified" over content the user never sees.

Client surface checklist

Not applicable — internal signing behavior. No API surface, schema, or migration; make generate untouched.

Merge order

Builds on #746 (fix/dkim-sign-present-headers) and is branched from it, since it modifies the function that PR introduces. Merge after #746.

Test plan

• go test ./internal/dkim/ — green
• make test-unit — full unit suite, 0 failures
• gofmt / go vet clean
• Prepended-duplicate detection across Subject, From, To, Reply-To, Message-ID, with an unmutated control asserted first
• signedHeaderKeys table extended: present headers listed n+1, an already-duplicated header listed 3 times, absent From still listed exactly once per RFC 6376 § 5.4
• Mutation-verified: reverting to single listing fails every spoof case

🤖 Generated with Claude Code