mailauth 5.0.1 → 5.0.3

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "5.0.1"
+    ".": "5.0.3"
 }

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [5.0.3](https://github.com/postalsys/mailauth/compare/v5.0.2...v5.0.3) (2026-09-03)
+
+
+### Bug Fixes
+
+* **dkim:** canonicalize a CR that is not a line ending as body content ([68dfb42](https://github.com/postalsys/mailauth/commit/68dfb4262fdae1bedb17019ab8c3c59bc2f4cf8d))
+* **dkim:** canonicalize a lone CR as body content in the simple algorithm ([aa54b0e](https://github.com/postalsys/mailauth/commit/aa54b0e75f65a274d2f56ea4df6f58bc86c080fc))
+* **dkim:** fold a header line that is not a well formed field ([227cf48](https://github.com/postalsys/mailauth/commit/227cf48fb42dbb93bcebfd1acbc8484032e03db9))
+* **dkim:** read the signature timestamp once per signature ([c8c6cd8](https://github.com/postalsys/mailauth/commit/c8c6cd8d41fd176d59522bde85022b7ab0f1e324))
+* **dkim:** sign and verify a message that has no body ([0b7c6ed](https://github.com/postalsys/mailauth/commit/0b7c6ed6723a8cdf2f65334af7d0783a373ab5e8))
+* **dkim:** stop emitting signatures and seals that cover nothing ([4eefa97](https://github.com/postalsys/mailauth/commit/4eefa9793fa6755d2e11b1fcaa4581b7f1b32515))
+* **dkim:** treat only SP and HTAB as whitespace in header canonicalization ([734db62](https://github.com/postalsys/mailauth/commit/734db62d09376c631e548f6c8b44a56ba38659c5))
+
+## [5.0.2](https://github.com/postalsys/mailauth/compare/v5.0.1...v5.0.2) (2026-08-19)
+
+
+### Bug Fixes
+
+* **spf:** expand %{d} macro to the domain currently being evaluated ([#126](https://github.com/postalsys/mailauth/issues/126)) ([53c4522](https://github.com/postalsys/mailauth/commit/53c45220a1af41febb5b901c251ed4cc66de511e))
+
 ## [5.0.1](https://github.com/postalsys/mailauth/compare/v5.0.0...v5.0.1) (2026-08-07)
 
 

package/index.d.ts

@@ -348,6 +348,12 @@ export interface ARCResult {
      */
     authResults?: string;
 
+    /**
+     * Why sealing failed, when a seal was requested but could not be created.
+     * The message is left unsealed in that case
+     */
+    sealErrors?: Error[];
+
     /**
      * ARC chain entries (non-enumerable property)
      * Access with result.chain or Object.getOwnPropertyDescriptor()
@@ -1089,9 +1095,9 @@ export function verifyASChain(data: ARCData, opts: ARCOptions): Promise<boolean>
  *
  * @param input - RFC822 formatted message or false for pre-calculated data
  * @param data - Seal creation data
- * @returns Seal headers
+ * @returns Seal headers, empty if the ARC-Message-Signature could not be signed, and any errors
  */
-export function createSeal(input: MessageInput | false, data: any): Promise<{ headers: string[] }>;
+export function createSeal(input: MessageInput | false, data: any): Promise<{ headers: string[]; errors: Error[] }>;
 
 // ============================================================================
 // BIMI

package/lib/arc/index.d.ts

@@ -42,6 +42,6 @@ export function verifyASChain(data: ARCData, opts: ARCOptions): Promise<boolean>
  *
  * @param input - RFC822 formatted message or false for pre-calculated data
  * @param data - Seal creation data
- * @returns Seal headers
+ * @returns Seal headers, empty if the ARC-Message-Signature could not be signed, and any errors
  */
-export function createSeal(input: MessageInput | false, data: any): Promise<{ headers: string[] }>;
+export function createSeal(input: MessageInput | false, data: any): Promise<{ headers: string[]; errors: Error[] }>;

package/lib/arc/index.js

@@ -4,6 +4,7 @@ const { Buffer } = require('node:buffer');
 const {
     parseDkimHeaders,
     formatRelaxedLine,
+    stripSignatureValue,
     getPublicKey,
     formatAuthHeaderRow,
     formatSignatureHeaderLine,
@@ -36,15 +37,7 @@ const verifyAS = async (chain, opts) => {
                 throw err;
             }
 
-            chunks.push(
-                Buffer.from(
-                    formatRelaxedLine(link['arc-seal'].original)
-                        .toString('binary')
-                        // remove value from b= key
-                        .replace(/([;:\s]+b=)[^;]+/, '$1'),
-                    'binary'
-                )
-            );
+            chunks.push(stripSignatureValue(formatRelaxedLine(link['arc-seal'].original)));
         }
     }
 
@@ -118,7 +111,7 @@ const signAS = async (chain, entry, signatureData) => {
 
         if (Object.prototype.toString.call(signTime) === '[object Date]' && signTime.toString() !== 'Invalid Date') {
             // we need a unix timestamp value
-            signTime = Math.round(signTime.getTime() / 1000);
+            signTime = Math.floor(signTime.getTime() / 1000);
             headerOpts.t = signTime;
         }
     }
@@ -135,15 +128,7 @@ const signAS = async (chain, entry, signatureData) => {
         true
     );
 
-    chunks.push(
-        Buffer.from(
-            formatRelaxedLine(canonSignatureHeaderLine)
-                .toString('binary')
-                // remove value from b= key
-                .replace(/([;:\s]+b=)[^;]+/, '$1'),
-            'binary'
-        )
-    );
+    chunks.push(stripSignatureValue(formatRelaxedLine(canonSignatureHeaderLine)));
 
     let canonicalizedHeader = Buffer.concat(chunks);
 
@@ -504,6 +489,15 @@ const createSeal = async (input, data) => {
 
     seal.i = seal.i || 1;
 
+    const messageSignature = dkimSigner.arc?.messageSignature;
+    if (!messageSignature) {
+        // The ARC-Message-Signature is missing whenever signing it failed, an unusable key
+        // being the usual reason. There is no ARC set to seal then: sealing anyway hashes
+        // a header that does not exist and puts an empty line into the header block, which
+        // ends it early for everything downstream
+        return { headers: [], errors: dkimSigner.errors };
+    }
+
     const authResults = `ARC-Authentication-Results: i=${seal.i}; ${seal.authResults}`;
 
     // Step 2. Calculate ARC-Seal
@@ -511,7 +505,7 @@ const createSeal = async (input, data) => {
         arc.chain,
         {
             'arc-authentication-results': authResults,
-            'arc-message-signature': dkimSigner.arc?.messageSignature
+            'arc-message-signature': messageSignature
         },
         {
             instance: seal.i,
@@ -526,7 +520,8 @@ const createSeal = async (input, data) => {
     );
 
     return {
-        headers: [arcSeal, dkimSigner?.arc?.messageSignature, authResults].map(v => v)
+        headers: [arcSeal, messageSignature, authResults],
+        errors: dkimSigner.errors
     };
 };
 

package/lib/dkim/body/line-endings.js

@@ -0,0 +1,34 @@
+'use strict';
+
+const { Buffer } = require('node:buffer');
+
+const CHAR_CR = 0x0d;
+const CHAR_LF = 0x0a;
+
+// A run of line endings at the end of the body is held back until it is known whether any
+// content follows it, because RFC 6376 drops it if none does. Both canonicalizations count
+// the CRLF pairs in that run instead of keeping the buffers they arrived in: the message
+// parser hands over one small buffer per line, and each of those pins the whole pool it
+// was allocated from, so a body of nothing but line breaks was retained about two hundred
+// times over. The pairs are written back out from this one shared buffer, which is built
+// with Buffer.alloc because Buffer.from would pool it and pin a slab for the same reason
+const EMPTY_LINE_BATCH = 512;
+const CRLF_RUN = Buffer.alloc(EMPTY_LINE_BATCH * 2);
+for (let i = 0; i < CRLF_RUN.length; i += 2) {
+    CRLF_RUN[i] = CHAR_CR;
+    CRLF_RUN[i + 1] = CHAR_LF;
+}
+
+const CRLF = CRLF_RUN.subarray(0, 2);
+
+// Calls back with every held back CRLF pair, in batches. The caller owns the counter and
+// has to clear it
+const eachHeldLineBreak = (count, fn) => {
+    while (count > 0) {
+        let batch = Math.min(count, EMPTY_LINE_BATCH);
+        fn(CRLF_RUN.subarray(0, batch * 2));
+        count -= batch;
+    }
+};
+
+module.exports = { CHAR_CR, CHAR_LF, CRLF, eachHeldLineBreak };

package/lib/dkim/body/relaxed.js

@@ -6,8 +6,8 @@ const { Buffer } = require('node:buffer');
 const crypto = require('node:crypto');
 const { MimeStructureStartFinder } = require('../mime-structure-start-finder');
 
-const CHAR_CR = 0x0d;
-const CHAR_LF = 0x0a;
+const { CHAR_CR, CHAR_LF, CRLF, eachHeldLineBreak } = require('./line-endings');
+
 const CHAR_SPACE = 0x20;
 const CHAR_TAB = 0x09;
 
@@ -40,7 +40,9 @@ class RelaxedHash {
 
         this.maxSizeReached = maxBodyLength === 0;
 
-        this.emptyLinesQueue = [];
+        // number of empty lines seen at the end of the body so far. They are hashed only
+        // once it is known that more content follows them
+        this.pendingLineBreaks = 0;
 
         this.mimeStructureStartFinder = new MimeStructureStartFinder();
     }
@@ -85,12 +87,8 @@ class RelaxedHash {
     }
 
     _drainPendingEmptyLines() {
-        if (this.emptyLinesQueue.length) {
-            for (let emptyLine of this.emptyLinesQueue) {
-                this._updateBodyHash(emptyLine);
-            }
-            this.emptyLinesQueue = [];
-        }
+        eachHeldLineBreak(this.pendingLineBreaks, lineBreaks => this._updateBodyHash(lineBreaks));
+        this.pendingLineBreaks = 0;
     }
 
     _pushBodyHash(chunk) {
@@ -98,28 +96,24 @@ class RelaxedHash {
             return;
         }
 
-        // remove line endings
-        let foundNonLn = false;
-
-        // buffer line endings and empty lines
-        for (let i = chunk.length - 1; i >= 0; i--) {
-            if (chunk[i] !== CHAR_LF && chunk[i] !== CHAR_CR) {
-                this._drainPendingEmptyLines();
-                if (i < chunk.length - 1) {
-                    this.emptyLinesQueue.push(chunk.subarray(i + 1));
-                    chunk = chunk.subarray(0, i + 1);
-                }
-                foundNonLn = true;
-                break;
-            }
+        // Count the line endings at the end of the chunk: these are the empty lines that
+        // are dropped if no more content follows. Everything that reaches this method has
+        // already been canonicalized, so the run is always whole CRLF pairs, see
+        // ./line-endings for why they are counted rather than kept
+        let end = chunk.length;
+        while (end >= 2 && chunk[end - 2] === CHAR_CR && chunk[end - 1] === CHAR_LF) {
+            end -= 2;
         }
 
-        if (!foundNonLn) {
-            this.emptyLinesQueue.push(chunk);
+        if (!end) {
+            this.pendingLineBreaks += chunk.length / 2;
             return;
         }
 
-        this._updateBodyHash(chunk);
+        this._drainPendingEmptyLines();
+        this.pendingLineBreaks = (chunk.length - end) / 2;
+
+        this._updateBodyHash(chunk.subarray(0, end));
     }
 
     /**
@@ -142,16 +136,16 @@ class RelaxedHash {
 
         for (let i = line.length - 1; i >= 0; i--) {
             if (line[i] === CHAR_LF) {
-                lineBuf[writePos--] = line[i];
-                if (i === 0 || line[i - 1] !== CHAR_CR) {
-                    // add missing carriage return
-                    lineBuf[writePos--] = CHAR_CR;
+                lineBuf[writePos--] = CHAR_LF;
+                lineBuf[writePos--] = CHAR_CR;
+                if (i > 0 && line[i - 1] === CHAR_CR) {
+                    // the <CR> of the line ending, any other <CR> is content
+                    i--;
                 }
-                continue;
-            }
-
-            if (line[i] === CHAR_CR) {
-                lineBuf[writePos--] = line[i];
+                // the scan has crossed into the previous line, whose own trailing
+                // whitespace has to go the same way
+                nonWspFound = false;
+                prevWsp = false;
                 continue;
             }
 
@@ -278,13 +272,16 @@ class RelaxedHash {
         if (final) {
             let chunkPart = (cursorPos && chunk && chunk.subarray(cursorPos)) || chunk;
             if (chunkPart && chunkPart.length) {
-                this._pushBodyHash(lineNeedsFixing ? this.fixLineBuffer(chunkPart) : chunkPart);
-                lineNeedsFixing = false;
+                // The last line has no line ending, so the scan above never looked at its
+                // trailing whitespace. A single trailing space is the only thing it can
+                // have missed: a run of them, and an HTAB anywhere, both set
+                // lineNeedsFixing, and nothing clears it again before the end of the line
+                this._pushBodyHash(lineNeedsFixing || chunkPart[chunkPart.length - 1] === CHAR_SPACE ? this.fixLineBuffer(chunkPart) : chunkPart);
             }
 
             if (this.bodyHashedBytes) {
                 // terminating line break for non-empty messages
-                this._updateBodyHash(Buffer.from([CHAR_CR, CHAR_LF]));
+                this._updateBodyHash(CRLF);
             }
         }
     }

package/lib/dkim/body/simple.js

@@ -4,6 +4,8 @@ const { Buffer } = require('node:buffer');
 const crypto = require('node:crypto');
 const { MimeStructureStartFinder } = require('../mime-structure-start-finder');
 
+const { CHAR_CR, CHAR_LF, CRLF, eachHeldLineBreak } = require('./line-endings');
+
 /**
  * Class for calculating body hash of an email message body stream
  * using the "simple" canonicalization
@@ -19,7 +21,10 @@ class SimpleHash {
         algorithm = (algorithm || 'sha256').split('-').pop();
         this.bodyHash = crypto.createHash(algorithm);
 
+        // line endings at the end of the body, held back until it is known whether content
+        // follows them. Whole CRLF pairs are only counted, see ./line-endings
         this.remainder = [];
+        this.pendingLineBreaks = 0;
 
         // total body size
         this.byteLength = 0;
@@ -31,8 +36,6 @@ class SimpleHash {
         this.maxBodyLength = maxBodyLength;
         this.maxSizeReached = maxBodyLength === 0;
 
-        this.lastNewline = false;
-
         this.mimeStructureStartFinder = new MimeStructureStartFinder();
     }
 
@@ -76,56 +79,89 @@ class SimpleHash {
     }
 
     update(chunk) {
-        this.byteLength += (chunk && chunk.length) || 0;
+        if (!chunk || !chunk.length) {
+            return;
+        }
+
+        this.byteLength += chunk.length;
         if (this.maxSizeReached) {
             return;
         }
 
-        if (this.remainder.length) {
-            // see if we can release the last remainder
-            for (let i = 0; i < chunk.length; i++) {
-                let c = chunk[i];
-                if (c !== 0x0a && c !== 0x0d) {
-                    // found non-line terminator byte, can release previous chunk
-                    for (let remainderChunk of this.remainder) {
-                        this._updateBodyHash(remainderChunk);
-                    }
-                    this.remainder = [];
-                }
-            }
+        // Find the line endings at the end of the chunk. They may be the *CRLF that ends
+        // the body, which digest() collapses, and a trailing <CR> may still pair up with
+        // an <LF> that opens the next chunk, so whether they are line endings is only
+        // known once something follows them. Peeling whole CRLF pairs first is what tells
+        // _holdBack the run can be counted rather than kept, without a second pass over it
+        let pairEnd = chunk.length;
+        while (pairEnd >= 2 && chunk[pairEnd - 2] === CHAR_CR && chunk[pairEnd - 1] === CHAR_LF) {
+            pairEnd -= 2;
         }
 
-        // find line terminators from the end of chunk
-        let matchStart = false;
-        for (let i = chunk.length - 1; i >= 0; i--) {
-            let c = chunk[i];
-            if (c === 0x0a || c === 0x0d) {
-                // stop looking
-                matchStart = i;
-            } else {
-                break;
-            }
+        let end = pairEnd;
+        while (end > 0 && (chunk[end - 1] === CHAR_LF || chunk[end - 1] === CHAR_CR)) {
+            end -= 1;
+        }
+
+        if (end) {
+            this._drainHeldLineEndings();
+            this._updateBodyHash(chunk.subarray(0, end));
         }
 
-        if (matchStart === 0) {
-            // nothing but newlines in this chunk
-            this.remainder.push(chunk);
+        if (end < chunk.length) {
+            this._holdBack(chunk, end, pairEnd);
+        }
+    }
+
+    _holdBack(chunk, end, pairEnd) {
+        if (!this.remainder.length && end === pairEnd) {
+            // nothing but whole CRLF pairs, and nothing kept before them to stay behind
+            this.pendingLineBreaks += (chunk.length - pairEnd) / 2;
             return;
-        } else if (matchStart !== false) {
-            this.remainder.push(chunk.slice(matchStart));
-            chunk = chunk.slice(0, matchStart);
         }
 
-        this._updateBodyHash(chunk);
-        this.lastNewline = chunk[chunk.length - 1] === 0x0a;
+        // a lone <CR> or <LF> the counter can not stand in for, so keep the exact bytes.
+        // Anything counted so far stays counted, it comes first either way
+        this.remainder.push(chunk.subarray(end));
+    }
+
+    _drainHeldLineEndings() {
+        eachHeldLineBreak(this.pendingLineBreaks, lineBreaks => this._updateBodyHash(lineBreaks));
+        this.pendingLineBreaks = 0;
+
+        for (let heldChunk of this.remainder) {
+            this._updateBodyHash(heldChunk);
+        }
+        this.remainder = [];
     }
 
     digest(encoding) {
-        if (!this.lastNewline || !this.bodyHashedBytes) {
-            // emit empty line buffer to keep the stream flowing
-            this._updateBodyHash(Buffer.from('\r\n'));
+        // RFC 6376 section 3.4.3: "simple" makes no changes to the body beyond converting
+        // the *CRLF at its end to a single CRLF. A <CR> that no <LF> follows does not end
+        // a line, so it is body content and stays where it is. A lone <LF> is taken as a
+        // line ending, the same way RelaxedHash takes it, and mailauth's message parser
+        // has already rewritten those to CRLF for anything read off the wire
+        let trailer = this.remainder.length === 1 ? this.remainder[0] : Buffer.concat(this.remainder);
+        let end = trailer.length;
+        while (end > 0 && trailer[end - 1] === CHAR_LF) {
+            end -= 1;
+            if (end > 0 && trailer[end - 1] === CHAR_CR) {
+                end -= 1;
+            }
         }
 
+        if (end) {
+            // content survived among the kept bytes, so the pairs counted before them are
+            // inside the body rather than at its end and have to be hashed after all
+            eachHeldLineBreak(this.pendingLineBreaks, lineBreaks => this._updateBodyHash(lineBreaks));
+            this._updateBodyHash(trailer.subarray(0, end));
+        }
+        // whatever is still held is the *CRLF at the end of the body, and collapses below
+        this.pendingLineBreaks = 0;
+
+        // a body with no trailing CRLF, and an empty body, both get one
+        this._updateBodyHash(CRLF);
+
         return this.bodyHash.digest(encoding);
     }
 

package/lib/dkim/dkim-signer.js

@@ -184,6 +184,22 @@ class DkimSigner extends MessageParser {
 
             let signingHeaderLines = getSigningHeaderLines(this.headers.parsed, this.headerList);
 
+            if (!signingHeaderLines.headers.some(header => header.key === 'from')) {
+                // RFC 6376 section 5.4: the From header field MUST be signed, and section
+                // 6.1.1 makes a signature that does not cover it a PERMFAIL for every
+                // verifier. Without this an input with no header at all is signed with an
+                // empty h= tag, which is not even valid sig-h-tag syntax
+                let err = new Error('Can not sign a message that has no From header');
+                err.code = 'ENOFROM';
+                this.errors.push({
+                    type: signatureData.type,
+                    selector: signatureData.selector,
+                    signingDomain: signatureData.signingDomain,
+                    err
+                });
+                continue;
+            }
+
             let { algorithm, signAlgo, hashAlgo } = this.getAlgorithm(signatureData);
             let { canonicalization, bodyCanon } = this.getCanonicalization(signatureData);
 

package/lib/dkim/dkim-verifier.js

@@ -124,8 +124,11 @@ class DkimVerifier extends MessageParser {
             signatureHeader.expiration =
                 signatureHeader.parsed?.x && !isNaN(signatureHeader.parsed?.x?.value) ? new Date(signatureHeader.parsed?.x?.value * 1000) : null;
 
+            // `l=0` is a valid sig-l-tag and means that no body byte is covered by the
+            // signature, so the value has to be tested for being a number, not for being
+            // truthy, or a zero length limit would be read as no limit at all
             signatureHeader.maxBodyLength =
-                signatureHeader.parsed?.l?.value && !isNaN(signatureHeader.parsed?.l?.value) ? signatureHeader.parsed?.l?.value : '';
+                typeof signatureHeader.parsed?.l?.value === 'number' && !isNaN(signatureHeader.parsed?.l?.value) ? signatureHeader.parsed?.l?.value : '';
 
             const validSignAlgo = ['rsa', 'ed25519'];
             const validHeaderAlgo = signatureHeader.type === 'DKIM' ? ['sha256', 'sha1'] : ['sha256'];
@@ -336,12 +339,6 @@ class DkimVerifier extends MessageParser {
                 signatureHeader.canonicalizedLength = this.bodyHashes.get(signatureHeader.bodyHashKey)?.canonicalizedLength;
                 signatureHeader.sourceBodyLength = this.bodyHashes.get(signatureHeader.bodyHashKey)?.byteLength;
 
-                if (typeof signatureHeader.maxBodyLength === 'number' && signatureHeader.maxBodyLength !== signatureHeader.bodyHashedBytes) {
-                    console.log('TOTAL', signatureHeader.bodyHashedBytes, 'EXPECTING', signatureHeader.maxBodyLength);
-                    //status.result = 'fail';
-                    //status.comment = `invalid body length ${signatureHeader.bodyHashedBytes}`;
-                }
-
                 let result = {
                     id: signatureHeader.parsed?.b?.value
                         ? crypto.createHash('sha256').update(Buffer.from(signatureHeader.parsed?.b?.value, 'base64')).digest('hex')

package/lib/dkim/header/relaxed.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const { Buffer } = require('node:buffer');
-const { formatSignatureHeaderLine, formatRelaxedLine, getCurTime } = require('../../../lib/tools');
+const { formatSignatureHeaderLine, formatRelaxedLine, stripSignatureValue, getCurTime } = require('../../../lib/tools');
 
 // generate headers for signing
 const relaxedHeaders = (type, signingHeaderLines, options) => {
@@ -34,9 +34,11 @@ const relaxedHeaders = (type, signingHeaderLines, options) => {
             opts.i = instance;
         }
 
-        if (signTime) {
-            opts.t = Math.floor(getCurTime(signTime).getTime() / 1000);
-        }
+        // The same opts object formats the line that gets signed here and, once the
+        // signature exists, the line that is emitted. Leaving t= out of it lets
+        // formatSignatureHeaderLine read the clock again for the second one, and a second
+        // boundary falling between the two reads signs one timestamp and publishes another
+        opts.t = Math.floor(getCurTime(signTime).getTime() / 1000);
 
         if (expires) {
             opts.x = Math.floor(getCurTime(expires).getTime() / 1000);
@@ -55,15 +57,7 @@ const relaxedHeaders = (type, signingHeaderLines, options) => {
         );
     }
 
-    chunks.push(
-        Buffer.from(
-            formatRelaxedLine(signatureHeaderLine)
-                .toString('binary')
-                // remove value from b= key
-                .replace(/([;:\s]+b=)[^;]+/, '$1'),
-            'binary'
-        )
-    );
+    chunks.push(stripSignatureValue(formatRelaxedLine(signatureHeaderLine)));
 
     return { canonicalizedHeader: Buffer.concat(chunks), signatureHeaderLine, dkimHeaderOpts: opts };
 };

package/lib/dkim/header/simple.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const { Buffer } = require('node:buffer');
-const { formatSignatureHeaderLine, getCurTime } = require('../../../lib/tools');
+const { formatSignatureHeaderLine, stripSignatureValue, getCurTime } = require('../../../lib/tools');
 
 const formatSimpleLine = (line, suffix) => Buffer.from(line.toString('binary') + (suffix ? suffix : ''), 'binary');
 
@@ -36,9 +36,11 @@ const simpleHeaders = (type, signingHeaderLines, options) => {
             opts.i = instance;
         }
 
-        if (signTime) {
-            opts.t = Math.floor(getCurTime(signTime).getTime() / 1000);
-        }
+        // The same opts object formats the line that gets signed here and, once the
+        // signature exists, the line that is emitted. Leaving t= out of it lets
+        // formatSignatureHeaderLine read the clock again for the second one, and a second
+        // boundary falling between the two reads signs one timestamp and publishes another
+        opts.t = Math.floor(getCurTime(signTime).getTime() / 1000);
 
         if (expires) {
             opts.x = Math.floor(getCurTime(expires).getTime() / 1000);
@@ -57,15 +59,7 @@ const simpleHeaders = (type, signingHeaderLines, options) => {
         );
     }
 
-    chunks.push(
-        Buffer.from(
-            formatSimpleLine(signatureHeaderLine)
-                .toString('binary')
-                // remove value from b= key
-                .replace(/([;:\s]+b=)[^;]+/, '$1'),
-            'binary'
-        )
-    );
+    chunks.push(stripSignatureValue(formatSimpleLine(signatureHeaderLine)));
 
     return { canonicalizedHeader: Buffer.concat(chunks), signatureHeaderLine, dkimHeaderOpts: opts };
 };

package/lib/dkim/message-parser.js

@@ -37,6 +37,17 @@ class MessageParser extends Writable {
         // Override in child class
     }
 
+    // Parses everything collected so far as the header block and hands it over. The body
+    // hash and the signatures are only ever built after this has run
+    async emitHeaders(chunk) {
+        this.state = 'body';
+        if (chunk) {
+            this.headerChunks.push(chunk);
+        }
+        this.headers = parseHeaders(Buffer.concat(this.headerChunks));
+        await this.messageHeaders(this.headers);
+    }
+
     async processChunk(chunk) {
         if (!chunk || !chunk.length) {
             return;
@@ -57,17 +68,12 @@ class MessageParser extends Writable {
 
                 if (b0 === 0x0a && (b1 === 0x0a || (b1 === 0x0d && b2 === 0x0a))) {
                     // found header ending
-                    this.state = 'body';
                     if (i === chunk.length - 1) {
                         //end of chunk
-                        this.headerChunks.push(chunk);
-                        this.headers = parseHeaders(Buffer.concat(this.headerChunks));
-                        await this.messageHeaders(this.headers);
+                        await this.emitHeaders(chunk);
                         return;
                     }
-                    this.headerChunks.push(chunk.slice(0, i + 1));
-                    this.headers = parseHeaders(Buffer.concat(this.headerChunks));
-                    await this.messageHeaders(this.headers);
+                    await this.emitHeaders(chunk.slice(0, i + 1));
                     chunk = chunk.slice(i + 1);
                     break;
                 }
@@ -132,13 +138,16 @@ class MessageParser extends Writable {
     }
 
     async finish() {
+        if (!this.headers) {
+            // no body, so no empty line ended the header block. Hand the headers out
+            // before the final chunk, which is where signatures are checked or created.
+            // An input with no bytes at all goes through here too, so that the rest of
+            // the pipeline always has a header set to look at
+            await this.emitHeaders();
+        }
+
         // generate final hash and emit it
         await this.finalChunk();
-
-        if (!this.headers && this.headerChunks.length) {
-            this.headers = parseHeaders(Buffer.concat(this.headerChunks));
-            await this.messageHeaders(this.headers);
-        }
     }
 
     _final(callback) {

package/lib/mailauth.js

@@ -184,6 +184,12 @@ const authenticate = async (input, opts) => {
             seal
         });
 
+        if (sealResult?.errors?.length) {
+            // sealing failed, usually an unusable key. The message goes out unsealed, so
+            // say why somewhere the caller can find it rather than dropping it silently
+            arcResult.sealErrors = sealResult.errors;
+        }
+
         sealResult?.headers?.reverse().forEach(header => headers.unshift(header));
     }
 

package/lib/spf/macro.js

@@ -12,11 +12,12 @@ const os = require('node:os');
  * @param {String} values.ip Sender IP address
  * @param {String} values.helo Client's HELO/EHLO domain
  * @param {String} [values.mta] Hostname of the MTA or MX server that processes the message
+ * @param {String} [values.domain] Domain currently being evaluated by check_host(), changes on include/redirect recursion (RFC 7208 sections 5.2, 6.1)
  */
 const macro = (input, values) => {
     input = (input || '').toString();
 
-    let { sender, ip, helo, mta } = values || {};
+    let { sender, ip, helo, mta, domain } = values || {};
 
     sender = (sender || '').toString();
     ip = (ip || '').toString();
@@ -64,11 +65,15 @@ const macro = (input, values) => {
                 break;
 
             case 'o':
-            case 'd':
             case 'p': // validated domain name is unsupported, instead we use the unvalidated sender domain
                 curval = senderDomain;
                 break;
 
+            case 'd':
+                // current <domain> of check_host(), not the sender domain (these only match at the top level)
+                curval = domain || senderDomain;
+                break;
+
             case 'i':
                 curval = ipaddr.parse(ip).toNormalizedString();
                 if (net.isIPv6(ip)) {

package/lib/spf/spf-verify.js

@@ -72,6 +72,9 @@ const spfVerify = async (domain, opts) => {
 
     let addr = ipaddr.parse(opts.ip);
 
+    // %{d} must expand to the domain currently being evaluated, which changes on include/redirect recursion
+    let macroValues = { sender: opts.sender, ip: opts.ip, helo: opts.helo, mta: opts.mta, domain };
+
     let resolver = opts.resolver || dns.resolve;
 
     let responses;
@@ -135,7 +138,7 @@ const spfVerify = async (domain, opts) => {
                 let modifier = part.substr(0, splitPos).toLowerCase();
                 let value = part.substr(splitPos + 1);
 
-                value = macro(value, opts)
+                value = macro(value, macroValues)
                     // remove trailing dot
                     .replace(/\.$/, '');
 
@@ -254,7 +257,7 @@ const spfVerify = async (domain, opts) => {
                 case 'include':
                     {
                         try {
-                            let redirect = macro(val, opts)
+                            let redirect = macro(val, macroValues)
                                 // remove trailing dot
                                 .replace(/\.$/, '');
                             let sub = await spfVerify(redirect, opts);
@@ -328,7 +331,7 @@ const spfVerify = async (domain, opts) => {
                         let { domain: a, cidr4, cidr6 } = parseCidrValue(val, domain, type);
                         let cidr = net.isIPv6(opts.ip) ? cidr6 : cidr4;
 
-                        a = macro(a, opts);
+                        a = macro(a, macroValues);
 
                         try {
                             a = punycode.toASCII(a);
@@ -354,7 +357,7 @@ const spfVerify = async (domain, opts) => {
                         let { domain: mxDomain, cidr4, cidr6 } = parseCidrValue(val, domain, type);
                         let cidr = net.isIPv6(opts.ip) ? cidr6 : cidr4;
 
-                        mxDomain = macro(mxDomain, opts);
+                        mxDomain = macro(mxDomain, macroValues);
 
                         try {
                             mxDomain = punycode.toASCII(mxDomain);
@@ -397,7 +400,7 @@ const spfVerify = async (domain, opts) => {
 
                 case 'exists':
                     {
-                        let existDomain = macro(val, opts);
+                        let existDomain = macro(val, macroValues);
                         try {
                             existDomain = punycode.toASCII(existDomain);
                         } catch (err) {
@@ -420,12 +423,8 @@ const spfVerify = async (domain, opts) => {
                             throw err;
                         }
 
-                        let ptrDomain;
-                        if (val) {
-                            ptrDomain = macro(val, opts);
-                        } else {
-                            ptrDomain = macro('%{d}', opts);
-                        }
+                        // bare "ptr" defaults to %{d}, the currently evaluated domain
+                        let ptrDomain = val ? macro(val, macroValues) : domain;
                         ptrDomain = formatDomain(ptrDomain);
 
                         // Step 1. Resolve PTR hostnames

package/lib/tools.js

@@ -76,14 +76,47 @@ const writeToStream = async (stream, input, chunkSize) => {
     });
 };
 
+// Lowercases a 'binary' string the way RFC 6376 section 3.4.2 means it. String.prototype
+// toLowerCase() is Unicode aware and maps the latin1 bytes 0xC0-0xDE to 0xE0-0xFE, which
+// corrupts a UTF-8 sequence and folds two distinct header names onto one. Only a string
+// that has such a byte needs the slower per character mapping
+const NON_ASCII = /[^\x00-\x7f]/;
+const lowerCaseASCII = str => (NON_ASCII.test(str) ? str.replace(/[A-Z]/g, c => c.toLowerCase()) : str.toLowerCase());
+
+// RFC 5322 section 3.6.8: field-name = 1*ftext, and ftext is printable US-ASCII except
+// the colon. A fold, and the obsolete syntax of section 4.5.8, may put whitespace between
+// the name and the colon
+const FIELD_START = /^[\x21-\x39\x3b-\x7e]+[ \t\r\n]*:/;
+
+// Whether a row opens a header of its own. Anything else is appended to the row above,
+// which is wider than the CRLF-then-WSP fold of RFC 5322 section 2.2.3 and deliberately
+// so: a line that is not a well formed field is read differently by different parsers,
+// and mailauth's own libmime, like most MUAs, appends any line it calls whitespace to the
+// value above it. Asking what a field looks like instead of what whitespace looks like
+// covers every spelling of it, including the multi-byte ones a leading byte test misses,
+// such as UTF-8 NBSP (C2 A0) and the ideographic space (E3 80 80). Appending a line can
+// only add bytes to a signed value, so it can only ever turn a pass into a fail; reading
+// the line the other way round is what cannot be undone. formatRelaxedLine is not lenient
+// in the same way, what a signature covers is RFC 6376 section 3.4.2 alone
+const startsField = row =>
+    // only the start of the row decides this, and a fold can push the colon no further
+    // than onto the line after the name
+    FIELD_START.test(row.length > 1 ? `${row[0]}\r\n${row[1]}` : row[0]);
+
 const parseHeaders = buf => {
     let rows = buf
         .toString('binary')
         .replace(/[\r\n]+$/, '')
         .split(/\r?\n/)
         .map(row => [row]);
-    for (let i = rows.length - 1; i >= 0; i--) {
-        if (i > 0 && /^\s/.test(rows[i][0])) {
+
+    if (rows.length === 1 && !rows[0][0]) {
+        // nothing to parse, rather than one row that is not a header
+        return { parsed: [], original: buf };
+    }
+
+    for (let i = rows.length - 1; i > 0; i--) {
+        if (!startsField(rows[i])) {
             rows[i - 1] = rows[i - 1].concat(rows[i]);
             rows.splice(i, 1);
         }
@@ -94,8 +127,15 @@ const parseHeaders = buf => {
         let key = row.match(/^[^:]+/);
         let casedKey;
         if (key) {
-            casedKey = key[0].trim();
-            key = casedKey.toLowerCase();
+            // a fold may sit between the field name and the colon, and the CRLF it leaves
+            // behind is not part of the name. Without this the key of a header folded that
+            // way matches nothing, and a From read by every MUA stops being a From here
+            casedKey = key[0];
+            if (casedKey.indexOf('\n') >= 0) {
+                casedKey = casedKey.replace(/\r?\n/g, '');
+            }
+            casedKey = casedKey.replace(/^[ \t]+|[ \t]+$/g, '');
+            key = lowerCaseASCII(casedKey);
         }
 
         return { key, casedKey, line: Buffer.from(row, 'binary') };
@@ -104,12 +144,21 @@ const parseHeaders = buf => {
     return { parsed: rows, original: buf };
 };
 
-const getSigningHeaderLines = (parsedHeaders, fieldNames, verify) => {
-    fieldNames = (typeof fieldNames === 'string' ? fieldNames : defaultDKIMFieldNames)
+// Normalizes an h= tag, or a configured header list, exactly as parseHeaders normalizes a
+// field name. Anything else and an entry names a key no parsed row can ever equal
+const normalizeFieldNames = fieldNames =>
+    fieldNames
         .split(':')
-        .map(key => key.trim().toLowerCase())
+        .map(key => lowerCaseASCII(key.replace(/^[ \t]+|[ \t]+$/g, '')))
         .filter(key => key);
 
+const defaultDKIMFieldNamesNormalized = normalizeFieldNames(defaultDKIMFieldNames);
+
+const getSigningHeaderLines = (parsedHeaders, fieldNames, verify) => {
+    // an h= tag is attacker controlled on inbound mail, so only the constant default list
+    // is normalized ahead of time
+    fieldNames = typeof fieldNames === 'string' ? normalizeFieldNames(fieldNames) : defaultDKIMFieldNamesNormalized;
+
     let signingList = [];
 
     if (verify) {
@@ -154,7 +203,7 @@ const formatSignatureHeaderLine = (type, values, folded) => {
             values = Object.assign(
                 {
                     v: 1,
-                    t: Math.round(Date.now() / 1000),
+                    t: Math.floor(Date.now() / 1000),
                     q: 'dns/txt'
                 },
                 values
@@ -166,7 +215,7 @@ const formatSignatureHeaderLine = (type, values, folded) => {
             keyOrdering = keyOrderingARC;
             values = Object.assign(
                 {
-                    t: Math.round(Date.now() / 1000),
+                    t: Math.floor(Date.now() / 1000),
                     q: 'dns/txt'
                 },
                 values
@@ -178,7 +227,7 @@ const formatSignatureHeaderLine = (type, values, folded) => {
             keyOrdering = keyOrderingAS;
             values = Object.assign(
                 {
-                    t: Math.round(Date.now() / 1000)
+                    t: Math.floor(Date.now() / 1000)
                 },
                 values
             );
@@ -194,7 +243,10 @@ const formatSignatureHeaderLine = (type, values, folded) => {
             .filter(key => values[key] !== false && typeof values[key] !== 'undefined' && values[key] !== null && keyOrdering.includes(key))
             .sort((a, b) => keyOrdering.indexOf(a) - keyOrdering.indexOf(b))
             .map(key => {
-                let val = values[key] || '';
+                // the filter above already dropped false, null and undefined, so a falsy
+                // value left here is a meaningful one. `l=0` is a valid sig-l-tag (RFC 6376
+                // section 3.5, 1*76DIGIT) and must not be serialized as a valueless `l=`
+                let val = values[key];
                 if (key === 'b' && folded && val) {
                     // fold signature value
                     return `${key}=${val}`.replace(/.{75}/g, '$& ').trim();
@@ -210,6 +262,7 @@ const formatSignatureHeaderLine = (type, values, folded) => {
                 }
 
                 if (key === 'i' && type === 'DKIM') {
+                    val = val.toString();
                     let atPos = val.indexOf('@');
                     if (atPos >= 0) {
                         let domainPart = val.substr(atPos + 1);
@@ -449,21 +502,35 @@ const formatAuthHeaderRow = (method, status) => {
     return parts.join(' ');
 };
 
+// RFC 6376 section 3.4.2. Only SP and HTAB are whitespace here: the line is a
+// 'binary' string, so a byte such as 0xA0 (the second byte of a UTF-8
+// non-breaking space) must not be collapsed or trimmed
 const formatRelaxedLine = (line, suffix) => {
     let result =
-        line
-            ?.toString('binary')
+        // a missing line is nothing to canonicalize. Optional chaining would resolve the
+        // whole chain to undefined and the concatenation below would then hash the
+        // 9 byte string "undefined" as if it were a header
+        (line || '')
+            .toString('binary')
             // unfold
             .replace(/\r?\n/g, '')
             // key to lowercase, trim around :
-            .replace(/^([^:]*):\s*/, (m, k) => k.toLowerCase().trim() + ':')
+            .replace(/^([^:]*):[ \t]*/, (m, k) => lowerCaseASCII(k).replace(/^[ \t]+|[ \t]+$/g, '') + ':')
             // single WSP
-            .replace(/\s+/g, ' ')
-            .trim() + (suffix ? suffix : '');
+            .replace(/[ \t]+/g, ' ')
+            // no WSP around the value
+            .replace(/^ | $/g, '') + (suffix ? suffix : '');
 
     return Buffer.from(result, 'binary');
 };
 
+// RFC 6376 section 3.7: when the signature header is hashed, its own b= value is treated
+// as empty. The tag can be preceded by WSP and, in a header that has not been unfolded
+// yet, by the CRLF of a fold. Nothing else is whitespace here, for the same reason it is
+// not in formatRelaxedLine: a byte such as 0xA0 in front of b= is content, and matching it
+// would strip a decoy tag and leave the real signature inside the hashed header
+const stripSignatureValue = line => Buffer.from(line.toString('binary').replace(/([;: \t\r\n]+b=)[^;]+/, '$1'), 'binary');
+
 const formatDomain = domain => {
     domain = domain.toLowerCase().trim();
     try {
@@ -568,15 +635,19 @@ function getCurTime(timeValue) {
             return timeValue;
         }
 
+        // `curTime.toString` is the method, never the string, so the guard below used to
+        // pass for every value and handed back an Invalid Date. That silently became a
+        // NaN timestamp in a signature, and a comparison that is false either way in the
+        // verifier, so an unparseable value falls back to the current time instead
         if (typeof timeValue === 'number' || !isNaN(timeValue)) {
             let timestamp = Number(timeValue);
             let curTime = new Date(timestamp);
-            if (curTime.toString !== 'Invalid Date') {
+            if (curTime.toString() !== 'Invalid Date') {
                 return curTime;
             }
         } else if (typeof timeValue === 'string') {
             let curTime = new Date(timeValue);
-            if (curTime.toString !== 'Invalid Date') {
+            if (curTime.toString() !== 'Invalid Date') {
                 return curTime;
             }
         }
@@ -774,6 +845,7 @@ module.exports = {
     getAlignment,
 
     formatRelaxedLine,
+    stripSignatureValue,
     formatDomain,
 
     getPtrHostname,

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mailauth",
-    "version": "5.0.1",
+    "version": "5.0.3",
     "description": "Email authentication library for Node.js",
     "main": "lib/mailauth.js",
     "types": "index.d.ts",