-
Notifications
You must be signed in to change notification settings - Fork 36
Home
This add-on verifies DKIM signatures according to the RFC 6376. The result of the verification is shown in the e-mail header, and optionally by a status bar, highlighting the sender's address or a tooltip for the From header.
Additionally, some actions, like the re-verification of the DKIM signature, are available through the "Other Actions" drop-down menu in the e-mail header. Also, sign rules can be used to specify that certain e-mails should always be signed. More about sign rules here.
A description of the available add-on options can be found here.
The add-on can be downloaded from https://addons.mozilla.org/addon/dkim-verifier/ or https://github.com/lieser/dkim_verifier/releases. The source code is available at https://github.com/lieser/dkim_verifier
Support is given at https://github.com/lieser/dkim_verifier/issues, http://forums.mozillazine.org/viewtopic.php?f=48&t=2704121 or by e-mail to dkim.verifier.addon@gmail.com (in English or German).
The preferred way to report bugs is by creating an issue at https://github.com/lieser/dkim_verifier/issues.
If debug information is needed, enabling of debugging in the advanced options is sufficient in most cases. Details about the available debug options can be found here.
The add-on probably fails to connect to the first DNS server. Disable the loading of DNS servers from the OS configuration (this are tried first) and only include in the "DNS name server" field working DNS servers. More info about the DNS options can be found here.
Most mailing list are breaking DKIM signatures by editing the subject or adding a footer. You can hide the DKIM header for this e-mails by adding a sign rule (more about it here).
Besides a bug, it may also be your mail provider, altering the incoming e-mails, for example by changing the encoding of the e-mail. Known mail provider/server to do so:
- Verizon (USA)
- Outlook.com / Hotmail / Microsoft SMTP Server
If you are not certain that the problem is caused by the mail provider, please report the issue and send some of the invalid e-mails as saved .eml files to dkim.verifier.addon@gmail.com, so I can try to find out that the problem is. If you don't have such an e-mail without personal information that you don't want me to see, I could also first send you a signed e-mail.
Make sure you are using the libunbound resolver. The default JavaScript DNS library does not support DNSSEC. More info about the DNS options can be found here.
There are two possible causes for this.
1. A sign rule says the e-mail should be signed.
Search in the "Signers rules" and "Default signers rules" for the responsible rule. If the rule is in "Signers rules" either modify or remove it. If the rule is in "Default signers rules" please report it. Until this is fixed in the default rules you can either create a custom rule overwriting the responsible default one (example here) or disable the usage of the default rules completely.
As this is only a heuristic it can produce false result. If you encounter such a false result create a custom sign rule for the problematic domain explicitly saying e-mails from the domain do not have to be necessarily signed (example here).
In some cases there is a problem with the local DNS forwarder "dnsmasq" returning no result even if the key exists. Disable the loading of DNS servers from the OS configuration to use a different DNS server. More info about the DNS options can be found here.
The easiest way to contribute is to report every error you encounter. Ideas for future enhancements are also welcome.
In case you are interested in providing a new translation (or improving an existing one), you can do this by either creating a pull request on github or via BabelZilla (http://www.babelzilla.org/forum/index.php?showtopic=7543).
Also feel free to fix bugs or add futures yourself by creating a pull request. For bigger changes best contact me first.