DKIM Body Hash signatures utilizing the "relaxed" algorithm do not function properly in Symantec Messaging Gateway for messages with an empty body

Products

• Messaging Gateway

Issue/Introduction

Symantec Messaging Gateway fails to valildate a DKIM body hash signature that uses the "relaxed" algorithm for messages that have an empty body.

When Symantec Messaging Gateway sends an empty body message using the "relaxed" body hash signature, the resulting message will fail to validate on other DKIM enabled receiving Mail Transfer Agents.

Cause

Symantec is investigating this issue. This document will be updated when new information is available.

Resolution

For outbound messages, use the "simple" algorithm for the body hash (this is the default configuration, so you may not need to make any changes):

1. Click on Protocols.
2. Click on Domains in the left pane.
3. Edit a domain that is configured for use of DKIM.
4. Click on the Delivery tab.
5. Click on the Show Advanced button in the DomainKeys Identified Mail section.
6. Select apply "simple" algorithm for the Body Canonicalization.
7. Click Save.

Currently there are no workarounds available for inbound messages.