Changes for version 0.30 - 2026-11-03
- Signers no longer look the Domain Policy Record up by default (contract E3.4, revised). A d= below the From domain signs only when the new Signer option ParentFromCallback ($from_domain, $signer) says so; with no callback it is refused, with the plain "From header field is not Authentic for d=..." (0.29's ": <reason>" suffix is gone). PolicyCallback/Resolver on the Signer remain as an explicit opt-in to the lookup. dkim2-milter --parent-from (single domain) or a parent-from file in a keydir domain's directory; DKIM2Sign per-domain parent_from_domains; dkim2sign --parent-from. Each matches its list through the new Common::parent_from_matcher (A-labels, case, one trailing dot).
- The Verifier prefetches the Domain Policy Records its From check will need (d= below the From domain), in the background with the keys, under the same conditions (_can_prefetch, PREFETCH_MAX, not with a PolicyCallback). fetch_domain_policy reads that answer first.
Documentation
Standalone DKIM2 milter for Postfix
Modules
DKIM2 signing and verification for email
the body hash of a message, streamed
every Message-Instance's body hash in one pass
Canonicalization, hashing, folding and key handling for DKIM2
DKIM2-signed Delivery Status Notifications
SHA-2 over message content, by OpenSSL where it can
decide whether a front end may sign a message
Streaming message parser base for Signer and Verifier
every Message-Instance's header hash without undo
Compute, verify and undo Message-Instance headers
Keep message snapshots keyed by Message-Instance
verify-and-reflect DKIM2 demonstration logic for dkim2.com
One DKIM2-Signature header, parsed or under construction
Sign a message with a DKIM2-Signature header
Bcc-safe recipient grouping before DKIM2 signing
The tag=value list a DKIM2 header is made of
structured per-level DKIM2 and Message-Instance report
Verify the DKIM2-Signature chain on a message
wrap a single-part message in a one-part multipart/mixed
Handler class for DKIM2 signing
Handler class for DKIM2 signature verification