mailauth 5.0.3 → 7.0.0

package/lib/dkim/dkim-verifier.js

@@ -1,7 +1,22 @@
 'use strict';
 
 const { Buffer } = require('node:buffer');
-const { getSigningHeaderLines, getPublicKey, parseDkimHeaders, formatAuthHeaderRow, getAlignment, getCurTime } = require('../../lib/tools');
+const {
+    getSigningHeaderLines,
+    parseDkimHeaders,
+    formatAuthHeaderRow,
+    getAlignment,
+    getCurTime,
+    toALabel,
+    normalizeDomainName,
+    isSameOrSubdomain,
+    addWarning,
+    KEY_ERROR_COMMENTS,
+    splitAlgorithm,
+    isSupportedAlgorithm,
+    createKeyCache
+} = require('../../lib/tools');
+const { DOMAIN_NAME, SELECTOR, TIMESTAMP, BODY_LENGTH } = require('./syntax');
 const { MessageParser } = require('./message-parser');
 const { dkimBody } = require('./body');
 const { generateCanonicalizedHeader } = require('./header');
@@ -10,6 +25,31 @@ const addressparser = require('nodemailer/lib/addressparser');
 const crypto = require('node:crypto');
 const libmime = require('libmime');
 
+// RFC 6376 section 3.5 syntax, used by the strict mode
+// sig-a-tag-alg = sig-a-tag-k "-" sig-a-tag-h, both ALPHA *(ALPHA / DIGIT)
+const ALGORITHM = /^[A-Za-z][A-Za-z0-9]*-[A-Za-z][A-Za-z0-9]*$/;
+// RFC 5322 dot-atom-text with the UTF-8 of RFC 6531, or a quoted-string, for the i= local-part
+const LOCAL_PART = /^(?:(?:[A-Za-z0-9!#$%&'*+\-/=?^_`{|}~]|[^\x00-\x7f])+(?:\.(?:[A-Za-z0-9!#$%&'*+\-/=?^_`{|}~]|[^\x00-\x7f])+)*|"(?:[^"\\\r\n]|\\.)*")$/;
+
+// Required tags of a DKIM-Signature (RFC 6376 section 3.5)
+const REQUIRED_DKIM_TAGS = ['v', 'a', 'b', 'bh', 'd', 'h', 's'];
+
+// Decodes dkim-quoted-printable (RFC 6376 section 2.11), used by the i= tag. FWS is not part
+// of the value
+const decodeDkimQuotedPrintable = value => {
+    let bytes = Buffer.from((value || '').toString().replace(/[ \t\r\n]+/g, ''), 'utf8');
+    let decoded = [];
+    for (let i = 0; i < bytes.length; i++) {
+        if (bytes[i] === 0x3d && i + 2 < bytes.length && /^[0-9A-Fa-f]{2}$/.test(bytes.subarray(i + 1, i + 3).toString())) {
+            decoded.push(parseInt(bytes.subarray(i + 1, i + 3).toString(), 16));
+            i += 2;
+        } else {
+            decoded.push(bytes[i]);
+        }
+    }
+    return Buffer.from(decoded).toString('utf8');
+};
+
 class DkimVerifier extends MessageParser {
     constructor(options) {
         super();
@@ -18,6 +58,9 @@ class DkimVerifier extends MessageParser {
         this.resolver = this.options.resolver;
         this.minBitLength = this.options.minBitLength;
 
+        // follow RFC 6376, RFC 8301 and RFC 8463 exactly instead of the lenient defaults
+        this.strict = !!this.options.strict;
+
         this.curTime = getCurTime(this.options.curTime);
 
         this.results = [];
@@ -26,10 +69,16 @@ class DkimVerifier extends MessageParser {
         this.bodyHashes = new Map();
 
         this.headerFrom = [];
+        this.fromFields = 0;
         this.envelopeFrom = false;
 
-        // ARC verification info
-        this.arc = { chain: false };
+        // ARC verification info, `warnings` lists what the lenient mode accepted in the chain
+        this.arc = { chain: false, warnings: [] };
+
+        // one key lookup per key record for the message. The ARC validation reuses it through
+        // the (hidden) keyCache property of the ARC data
+        this.keyCache = createKeyCache(this.resolver);
+        Object.defineProperty(this.arc, 'keyCache', { value: this.keyCache, enumerable: false, configurable: true, writable: true });
 
         // should we also seal this message using ARC
         this.seal = this.options.seal;
@@ -47,7 +96,7 @@ class DkimVerifier extends MessageParser {
         this.headers = headers;
 
         try {
-            this.arc.chain = getARChain(headers);
+            this.arc.chain = getARChain(headers, { strict: this.strict, warnings: this.arc.warnings });
             if (this.arc.chain?.length) {
                 this.arc.lastEntry = this.arc.chain[this.arc.chain.length - 1];
             }
@@ -58,12 +107,15 @@ class DkimVerifier extends MessageParser {
         this.signatureHeaders = headers.parsed
             .filter(h => h.key === 'dkim-signature')
             .map(h => {
-                const value = parseDkimHeaders(h.line);
+                // RFC 6376 section 3.2: tag names are case-sensitive, so in the strict mode "D="
+                // is an unknown tag and not the d= tag
+                const value = parseDkimHeaders(h.line, { strict: this.strict });
                 value.type = 'DKIM';
                 return value;
             });
 
         let fromHeaders = headers?.parsed?.filter(h => h.key === 'from');
+        this.fromFields = fromHeaders.length;
         for (let fromHeader of fromHeaders) {
             fromHeader = fromHeader.line.toString();
             let splitterPos = fromHeader.indexOf(':');
@@ -72,8 +124,13 @@ class DkimVerifier extends MessageParser {
             }
             let from = addressparser(fromHeader.trim());
             for (let addr of from) {
-                if (addr && addr.address) {
-                    this.headerFrom.push(addr.address);
+                // RFC 6854 allows a group in From, and the mailboxes of the group are authors
+                // like any other. Leaving them out would leave DMARC without an Author Domain
+                for (let mailbox of [].concat(addr?.group || addr || [])) {
+                    if (mailbox && mailbox.address) {
+                        // the full addr-spec, the domain is what follows its last "@"
+                        this.headerFrom.push(mailbox.address);
+                    }
                 }
             }
         }
@@ -94,62 +151,38 @@ class DkimVerifier extends MessageParser {
             }
         }
 
-        // include newest ARC-Message-Signature as one of the signature headers to check for
+        // include newest ARC-Message-Signature as one of the signature headers to check for.
+        // The ARC-Seal is validated by the ARC module, it is not a DKIM signature, so it is
+        // not evaluated here (a c= tag on it used to make it one, and it ended up in the
+        // DKIM results)
         if (this.arc.lastEntry) {
             const signatureHeader = this.arc.lastEntry['arc-message-signature'];
             signatureHeader.type = 'ARC';
             this.signatureHeaders.push(signatureHeader);
 
-            const sealHeader = this.arc.lastEntry['arc-seal'];
-            sealHeader.type = 'AS';
-            this.signatureHeaders.push(sealHeader);
+            if (!this.strict && !signatureHeader.parsed?.c) {
+                // Without c= the ARC-Message-Signature uses simple/simple, the DKIM-Signature
+                // default (RFC 8617 section 4.1.2, RFC 6376 section 3.5). Older versions of this
+                // library, and the ARC drafts, used relaxed/relaxed instead, so the lenient mode
+                // also tries that when simple/simple does not verify, and marks the result
+                signatureHeader.fallbackCanonicalization = 'relaxed/relaxed';
+            }
         }
 
         for (let signatureHeader of this.signatureHeaders) {
-            signatureHeader.algorithm = signatureHeader.parsed?.a?.value || '';
-            signatureHeader.signAlgo = signatureHeader.algorithm.split('-').shift().toLowerCase().trim();
-            signatureHeader.hashAlgo = signatureHeader.algorithm.split('-').pop().toLowerCase().trim();
-
-            signatureHeader.canonicalization = signatureHeader.parsed?.c?.value || '';
-            signatureHeader.headerCanon = signatureHeader.canonicalization.split('/').shift().toLowerCase().trim() || 'simple';
-            // if body canonicalization is not set, then defaults to 'simple'
-            signatureHeader.bodyCanon = (signatureHeader.canonicalization.split('/')[1] || 'simple').toLowerCase().trim();
-
-            signatureHeader.signingDomain = signatureHeader.parsed?.d?.value || '';
-            signatureHeader.selector = signatureHeader.parsed?.s?.value || '';
-
-            signatureHeader.timestamp =
-                signatureHeader.parsed?.t && !isNaN(signatureHeader.parsed?.t?.value) ? new Date(signatureHeader.parsed?.t?.value * 1000) : null;
-
-            signatureHeader.expiration =
-                signatureHeader.parsed?.x && !isNaN(signatureHeader.parsed?.x?.value) ? new Date(signatureHeader.parsed?.x?.value * 1000) : null;
-
-            // `l=0` is a valid sig-l-tag and means that no body byte is covered by the
-            // signature, so the value has to be tested for being a number, not for being
-            // truthy, or a zero length limit would be read as no limit at all
-            signatureHeader.maxBodyLength =
-                typeof signatureHeader.parsed?.l?.value === 'number' && !isNaN(signatureHeader.parsed?.l?.value) ? signatureHeader.parsed?.l?.value : '';
-
-            const validSignAlgo = ['rsa', 'ed25519'];
-            const validHeaderAlgo = signatureHeader.type === 'DKIM' ? ['sha256', 'sha1'] : ['sha256'];
-            const validHeaderCanon = signatureHeader.type !== 'AS' ? ['relaxed', 'simple'] : ['relaxed'];
-            const validBodyCanon = signatureHeader.type !== 'AS' ? ['relaxed', 'simple'] : ['relaxed'];
-
-            if (
-                !validSignAlgo.includes(signatureHeader.signAlgo) ||
-                !validHeaderAlgo.includes(signatureHeader.hashAlgo) ||
-                !validHeaderCanon.includes(signatureHeader.headerCanon) ||
-                !validBodyCanon.includes(signatureHeader.bodyCanon) ||
-                !signatureHeader.signingDomain ||
-                !signatureHeader.selector
-            ) {
-                signatureHeader.skip = true;
+            this.prepareSignature(signatureHeader);
+
+            if (signatureHeader.skip || signatureHeader.invalid) {
                 continue;
             }
 
-            signatureHeader.bodyHashKey = [signatureHeader.bodyCanon, signatureHeader.hashAlgo, signatureHeader.maxBodyLength].join(':');
-            if (!this.bodyHashes.has(signatureHeader.bodyHashKey)) {
-                this.bodyHashes.set(signatureHeader.bodyHashKey, dkimBody(signatureHeader.bodyCanon, signatureHeader.hashAlgo, signatureHeader.maxBodyLength));
+            signatureHeader.bodyHashKey = this.addBodyHash(signatureHeader.bodyCanon, signatureHeader.hashAlgo, signatureHeader.maxBodyLength);
+            if (signatureHeader.fallbackCanonicalization) {
+                signatureHeader.fallbackBodyHashKey = this.addBodyHash(
+                    getBodyCanon(signatureHeader.fallbackCanonicalization),
+                    signatureHeader.hashAlgo,
+                    signatureHeader.maxBodyLength
+                );
             }
 
             let headersArray = this.headers.parsed;
@@ -171,6 +204,197 @@ class DkimVerifier extends MessageParser {
         }
     }
 
+    // Registers a body hash, once for every canonicalization, hash and length combination
+    addBodyHash(bodyCanon, hashAlgo, maxBodyLength) {
+        let bodyHashKey = [bodyCanon, hashAlgo, maxBodyLength].join(':');
+        if (!this.bodyHashes.has(bodyHashKey)) {
+            this.bodyHashes.set(bodyHashKey, dkimBody(bodyCanon, hashAlgo, maxBodyLength));
+        }
+        return bodyHashKey;
+    }
+
+    /**
+     * Reads the tags of a signature header and validates them (RFC 6376 section 6.1.1).
+     *
+     * Sets `skip` for a signature that is not processed at all: the lenient mode leaves those
+     * out of the results as it always has, the strict mode reports them as neutral. Sets
+     * `invalid` to a reason for a signature that is reported as neutral without looking up
+     * its key. Collects `warnings` for what the lenient mode accepts and the strict mode would
+     * not.
+     */
+    prepareSignature(signatureHeader) {
+        const strict = this.strict;
+        const isDkim = signatureHeader.type === 'DKIM';
+
+        signatureHeader.warnings = [];
+        const warn = warning => addWarning(signatureHeader.warnings, warning);
+        // A rule the strict mode enforces: returns true when the signature is invalid for it,
+        // otherwise notes the warning (if any) and returns false
+        const violation = (reason, warning) => {
+            if (strict) {
+                signatureHeader.invalid = reason;
+                return true;
+            }
+            if (warning) {
+                warn(warning);
+            }
+            return false;
+        };
+
+        // the raw tag values, as they were written, for the syntax checks
+        const rawTags = new Map();
+        for (let tag of signatureHeader.tags || []) {
+            rawTags.set(tag.name, tag.value);
+        }
+
+        let tagListErrors = signatureHeader.syntaxErrors || [];
+        let hasCaseFoldedTags = (signatureHeader.tags || []).some(tag => tag.name !== tag.name.toLowerCase());
+
+        const parsed = signatureHeader.parsed || {};
+
+        signatureHeader.algorithm = (parsed.a?.value || '').toString();
+        Object.assign(signatureHeader, splitAlgorithm(signatureHeader.algorithm));
+
+        signatureHeader.canonicalization = (parsed.c?.value || '').toString();
+        signatureHeader.headerCanon = signatureHeader.canonicalization.split('/').shift().toLowerCase().trim() || 'simple';
+        signatureHeader.bodyCanon = getBodyCanon(signatureHeader.canonicalization);
+
+        signatureHeader.signingDomain = (parsed.d?.value || '').toString();
+        signatureHeader.selector = (parsed.s?.value || '').toString();
+
+        signatureHeader.timestamp = parsed.t && !isNaN(parsed.t.value) ? new Date(parsed.t.value * 1000) : null;
+
+        signatureHeader.expiration = parsed.x && !isNaN(parsed.x.value) ? new Date(parsed.x.value * 1000) : null;
+
+        // `l=0` is a valid sig-l-tag and means that no body byte is covered by the
+        // signature, so the value has to be tested for being a number, not for being
+        // truthy, or a zero length limit would be read as no limit at all
+        signatureHeader.maxBodyLength = typeof parsed.l?.value === 'number' && !isNaN(parsed.l.value) ? parsed.l.value : '';
+
+        // AUID, "@d" when i= is not set (RFC 6376 section 3.5)
+        if (isDkim && parsed.i && typeof parsed.i.value === 'string') {
+            signatureHeader.identity = decodeDkimQuotedPrintable(parsed.i.value);
+        } else if (isDkim) {
+            signatureHeader.identity = signatureHeader.signingDomain ? `@${signatureHeader.signingDomain}` : '';
+        }
+
+        const validCanon = ['relaxed', 'simple'];
+
+        // rsa-sha1 is only a DKIM algorithm, ARC signatures always use sha256
+        if (!isSupportedAlgorithm(signatureHeader.signAlgo, signatureHeader.hashAlgo, isDkim) || (strict && !ALGORITHM.test(signatureHeader.algorithm))) {
+            signatureHeader.skip = 'unknown algorithm';
+            return;
+        }
+
+        if (!validCanon.includes(signatureHeader.headerCanon) || !validCanon.includes(signatureHeader.bodyCanon)) {
+            signatureHeader.skip = 'unknown canonicalization';
+            return;
+        }
+
+        if (!signatureHeader.signingDomain || !signatureHeader.selector) {
+            signatureHeader.skip = 'signature missing required tag';
+            return;
+        }
+
+        if (isDkim) {
+            // RFC 6376 section 3.2 and 6.1.1
+            if (tagListErrors.length && violation('signature syntax error', 'tag-syntax')) {
+                return;
+            }
+            if (hasCaseFoldedTags) {
+                warn('tag-syntax');
+            }
+
+            let missingTags = REQUIRED_DKIM_TAGS.filter(tag => !parsed[tag]);
+            if (missingTags.length) {
+                if (violation('signature missing required tag')) {
+                    return;
+                }
+                // without h= the default header list is used, which does include From
+                missingTags.forEach(tag => warn(`missing-${tag}`));
+            }
+
+            // "Verifiers MUST return PERMFAIL (incompatible version)"
+            if (parsed.v && rawTags.get('v') !== '1' && violation('incompatible version', 'invalid-v')) {
+                return;
+            }
+
+            let numericError = [
+                ['t', TIMESTAMP],
+                ['x', TIMESTAMP],
+                ['l', BODY_LENGTH]
+            ].some(([tag, format]) => parsed[tag] && !format.test(rawTags.get(tag) || ''));
+            if (numericError && violation('signature syntax error', 'tag-syntax')) {
+                return;
+            }
+
+            // "This list MUST NOT be empty", the From check below covers the lenient mode
+            if (parsed.h && !normalizeFieldList(parsed.h.value).length && violation('signature syntax error')) {
+                return;
+            }
+
+            let invalidNames = !DOMAIN_NAME.test(toALabel(signatureHeader.signingDomain)) || !SELECTOR.test(toALabel(signatureHeader.selector));
+            if (invalidNames && violation('signature syntax error', 'tag-syntax')) {
+                return;
+            }
+
+            if (parsed.q) {
+                // "dns/txt" is the only query method, unrecognized ones are ignored
+                let methods = (parsed.q.value || '')
+                    .toString()
+                    .split(':')
+                    .map(method => method.trim().toLowerCase());
+                if (!methods.includes('dns/txt') && violation('unsupported query method', 'query-method')) {
+                    return;
+                }
+            }
+
+            if (parsed.i) {
+                // RFC 6376 section 6.1.1: the i= domain has to be d= or one of its subdomains
+                let identity = signatureHeader.identity;
+                let atPos = identity.lastIndexOf('@');
+                let localPart = atPos >= 0 ? identity.substring(0, atPos) : '';
+                let identityDomain = atPos >= 0 ? identity.substring(atPos + 1) : '';
+
+                let validSyntax = atPos >= 0 && (!localPart || LOCAL_PART.test(localPart)) && DOMAIN_NAME.test(toALabel(identityDomain));
+                let validDomain = atPos >= 0 && isSameOrSubdomain(identityDomain, signatureHeader.signingDomain);
+
+                if ((!validSyntax || !validDomain) && violation(validSyntax ? 'domain mismatch' : 'signature syntax error', 'identity-domain')) {
+                    return;
+                }
+                signatureHeader.identityDomain = identityDomain;
+            }
+
+            if (signatureHeader.timestamp && signatureHeader.expiration && signatureHeader.expiration <= signatureHeader.timestamp) {
+                // "The value of the x= tag MUST be greater than the value of the t= tag". An x=
+                // before t= fails in both modes, an x= equal to t= only in the strict mode
+                if (violation('invalid expiration')) {
+                    return;
+                }
+                if (signatureHeader.expiration.getTime() === signatureHeader.timestamp.getTime()) {
+                    warn('invalid-expiration');
+                }
+            }
+
+            if (signatureHeader.hashAlgo === 'sha1') {
+                // RFC 8301 section 3.1: rsa-sha1 MUST NOT be used for verifying. Only the
+                // strict mode rejects it, the lenient mode lets the key owner opt out of it
+                // with the h= tag of the key record
+                warn('rsa-sha1');
+            }
+        }
+
+        // RFC 6376 section 6.1.1: a signature that does not cover From is ignored in every
+        // mode. It says nothing about the author the DMARC check is about, and the From
+        // header could have been replaced after signing. The same applies to the
+        // ARC-Message-Signature, which has the DKIM-Signature syntax (RFC 8617 section 4.1.2)
+        let signedFields = parsed.h ? normalizeFieldList(parsed.h.value) : ['from'];
+        if (!signedFields.includes('from')) {
+            signatureHeader.invalid = 'From field not signed';
+            return;
+        }
+    }
+
     async nextChunk(chunk) {
         for (let bodyHash of this.bodyHashes.values()) {
             bodyHash.update(chunk);
@@ -190,220 +414,328 @@ class DkimVerifier extends MessageParser {
         return true;
     }
 
-    async finalChunk() {
-        try {
-            if (!this.headers || !this.bodyHashes.size) {
-                return;
-            }
+    getStatusHeader(signatureHeader) {
+        let header = {};
+
+        if (this.strict && signatureHeader.type === 'DKIM') {
+            // RFC 8601 section 2.7.1: header.d is the d= domain and header.i the AUID, which is
+            // the i= value or "@d" when there is no i=. Both use the domain-name syntax of
+            // RFC 6376 section 3.5, where an internationalized domain name is an A-label
+            let identity = signatureHeader.identity || '';
+            let atPos = identity.lastIndexOf('@');
+            header.d = signatureHeader.signingDomain ? toALabel(signatureHeader.signingDomain) : false;
+            header.i = identity ? (atPos >= 0 ? identity.substring(0, atPos + 1) + toALabel(identity.substring(atPos + 1)) : identity) : false;
+        } else {
+            // signing domain
+            header.i = signatureHeader.signingDomain ? `@${signatureHeader.signingDomain}` : false;
+        }
 
-            // convert bodyHashes from hash objects to base64 strings
-            for (let [key, bodyHash] of this.bodyHashes.entries()) {
-                this.bodyHashes.get(key).hash = bodyHash.digest('base64');
-                this.bodyHashes.get(key).mimeStructureStart = bodyHash.getMimeStructureStart();
-            }
+        // dkim selector
+        header.s = signatureHeader.selector;
+        // algo
+        header.a = signatureHeader.parsed?.a?.value;
+        // signature value
+        header.b = signatureHeader.parsed?.b?.value ? `${signatureHeader.parsed?.b?.value.toString().substr(0, 8)}` : false;
 
-            for (let signatureHeader of this.signatureHeaders) {
-                if (signatureHeader.skip) {
-                    // TODO: add failing header line?
-                    continue;
-                }
+        return header;
+    }
 
-                let signingHeaderLines = getSigningHeaderLines(this.headers.parsed, signatureHeader.parsed?.h?.value, true);
+    // The result properties every signature has, whether it was verified or not
+    baseResult(signatureHeader, format) {
+        return {
+            id: signatureHeader.parsed?.b?.value
+                ? crypto.createHash('sha256').update(Buffer.from(signatureHeader.parsed.b.value.toString(), 'base64')).digest('hex')
+                : crypto.randomUUID(),
+            signingDomain: signatureHeader.signingDomain,
+            selector: signatureHeader.selector,
+            signature: signatureHeader.parsed?.b?.value,
+            algo: signatureHeader.parsed?.a?.value,
+            format
+        };
+    }
 
-                let { canonicalizedHeader } = generateCanonicalizedHeader(signatureHeader.type, signingHeaderLines, {
-                    signatureHeaderLine: signatureHeader.original,
-                    canonicalization: signatureHeader.canonicalization,
-                    instance: ['ARC', 'AS'].includes(signatureHeader.type) ? signatureHeader.parsed?.i?.value : false
-                });
+    /**
+     * Verifies a signature
+     *
+     * @param {Object} signatureHeader Signature prepared by prepareSignature()
+     * @param {Boolean} [fallback] If true, verify with `fallbackCanonicalization` instead of the
+     *        canonicalization of the signature. The result is then built as if the signature
+     *        had that c= value, and the signature header object is not updated
+     * @returns {Object} Signature result
+     */
+    async verifySignature(signatureHeader, fallback) {
+        const canonicalization = fallback ? signatureHeader.fallbackCanonicalization : signatureHeader.canonicalization;
+        const bodyHashKey = fallback ? signatureHeader.fallbackBodyHashKey : signatureHeader.bodyHashKey;
+
+        let signingHeaderLines = getSigningHeaderLines(this.headers.parsed, signatureHeader.parsed?.h?.value, true);
+
+        let { canonicalizedHeader } = generateCanonicalizedHeader(signatureHeader.type, signingHeaderLines, {
+            signatureHeaderLine: signatureHeader.original,
+            canonicalization,
+            instance: signatureHeader.type === 'ARC' ? signatureHeader.parsed?.i?.value : false,
+            strict: this.strict
+        });
+
+        let signingHeaders = {
+            keys: signingHeaderLines.keys,
+            headers: signingHeaderLines.headers.map(l => l.line.toString()),
+            canonicalizedHeader: canonicalizedHeader.toString('base64')
+        };
+
+        let publicKey, rr, modulusLength;
+        let status = {
+            result: 'neutral',
+            comment: false,
+            // ptype properties
+            header: this.getStatusHeader(signatureHeader)
+        };
+
+        if (signatureHeader.type === 'DKIM' && this.headerFrom?.length) {
+            status.aligned = getAlignment(this.headerFrom[0].split('@').pop(), [signatureHeader.signingDomain])?.domain || false;
+        }
 
-                let signingHeaders = {
-                    keys: signingHeaderLines.keys,
-                    headers: signingHeaderLines.headers.map(l => l.line.toString()),
-                    canonicalizedHeader: canonicalizedHeader.toString('base64')
-                };
-
-                let publicKey, rr, modulusLength;
-                let status = {
-                    result: 'neutral',
-                    comment: false,
-                    // ptype properties
-                    header: {
-                        // signing domain
-                        i: signatureHeader.signingDomain ? `@${signatureHeader.signingDomain}` : false,
-                        // dkim selector
-                        s: signatureHeader.selector,
-                        // algo
-                        a: signatureHeader.parsed?.a?.value,
-                        // signature value
-                        b: signatureHeader.parsed?.b?.value ? `${signatureHeader.parsed?.b?.value.substr(0, 8)}` : false
+        const bodyHasher = this.bodyHashes.get(bodyHashKey);
+        const bodyHash = bodyHasher?.hash;
+        const mimeStructureStart = bodyHasher?.mimeStructureStart;
+
+        const warnings = [].concat(signatureHeader.warnings || []);
+
+        if (signatureHeader.invalid) {
+            // RFC 6376 section 6.1.1 PERMFAIL, reported as neutral, which RFC 8601 section
+            // 2.7.1 uses for a signature with syntax errors. The key is not looked up
+            status.result = 'neutral';
+            status.comment = signatureHeader.invalid;
+        } else if (signatureHeader.parsed?.bh?.value !== bodyHash) {
+            // RFC 6376 section 6.1.3 step 3 is a PERMFAIL, which RFC 8601 reports as "fail".
+            // The lenient mode keeps reporting neutral, as it always has
+            status.result = this.strict ? 'fail' : 'neutral';
+            status.comment = `body hash did not verify`;
+        } else if (this.strict && signatureHeader.type === 'DKIM' && signatureHeader.hashAlgo === 'sha1') {
+            // RFC 8301 section 3.1, "rsa-sha1 MUST NOT be used for signing or verifying"
+            status.result = 'policy';
+            status.comment = 'weak algorithm';
+            status.policy = { 'dkim-rules': 'weak-algorithm' };
+        } else {
+            try {
+                let res = await this.keyCache.get(
+                    signatureHeader.type,
+                    `${signatureHeader.selector}._domainkey.${signatureHeader.signingDomain}`,
+                    this.minBitLength,
+                    {
+                        strict: this.strict,
+                        hashAlgo: signatureHeader.hashAlgo
                     }
-                };
+                );
+
+                publicKey = res?.publicKey;
+                rr = res?.rr;
+                modulusLength = res?.modulusLength;
 
-                if (signatureHeader.type === 'DKIM' && this.headerFrom?.length) {
-                    status.aligned = this.headerFrom?.length
-                        ? getAlignment(this.headerFrom[0].split('@').pop(), [signatureHeader.signingDomain])?.domain || false
-                        : false;
+                addWarning(warnings, ...(res?.warnings || []));
+
+                if (res?.testing) {
+                    // key t=y, the domain is testing DKIM (RFC 6376 section 3.6.1)
+                    status.testing = true;
                 }
 
-                const bodyHash = this.bodyHashes.get(signatureHeader.bodyHashKey)?.hash;
-                const mimeStructureStart = this.bodyHashes.get(signatureHeader.bodyHashKey)?.mimeStructureStart;
+                let keyError = false;
+                if (this.strict && res?.keyType && res.keyType !== signatureHeader.signAlgo) {
+                    // RFC 6376 section 6.1.2 step 8. The lenient mode lets the crypto library
+                    // report the mismatch, as it always has
+                    keyError = 'inappropriate key algorithm';
+                } else if (
+                    res?.flags?.includes('s') &&
+                    signatureHeader.identityDomain &&
+                    normalizeDomainName(signatureHeader.identityDomain) !== normalizeDomainName(signatureHeader.signingDomain)
+                ) {
+                    // key t=s: "the i= domain MUST NOT be a subdomain of d="
+                    if (this.strict) {
+                        keyError = 'domain mismatch';
+                    } else {
+                        addWarning(warnings, 'identity-domain');
+                    }
+                }
 
-                if (signatureHeader.parsed?.bh?.value !== bodyHash) {
+                if (keyError) {
                     status.result = 'neutral';
-                    status.comment = `body hash did not verify`;
+                    status.comment = keyError;
                 } else {
                     try {
-                        let res = await getPublicKey(
-                            signatureHeader.type,
-                            `${signatureHeader.selector}._domainkey.${signatureHeader.signingDomain}`,
-                            this.minBitLength,
-                            this.resolver
-                        );
-
-                        publicKey = res?.publicKey;
-                        rr = res?.rr;
-                        modulusLength = res?.modulusLength;
-
-                        try {
-                            status.result = crypto.verify(
-                                signatureHeader.signAlgo === 'rsa' ? signatureHeader.algorithm : null,
-                                signatureHeader.signAlgo === 'rsa' ? canonicalizedHeader : crypto.createHash('sha256').update(canonicalizedHeader).digest(),
-                                publicKey,
-                                Buffer.from(signatureHeader.parsed?.b?.value, 'base64')
-                            )
-                                ? 'pass'
-                                : 'fail';
-
-                            if (status.result === 'fail') {
-                                status.comment = 'bad signature';
-                            }
-
-                            if (status.result === 'pass') {
-                                if (signatureHeader.expiration && signatureHeader.timestamp && signatureHeader.expiration < signatureHeader.timestamp) {
-                                    status.result = 'neutral';
-                                    status.comment = 'invalid expiration';
-                                }
-
-                                if (signatureHeader.expiration && signatureHeader.expiration < this.curTime) {
-                                    status.result = 'neutral';
-                                    status.comment = 'expired';
-                                }
-                            }
-                        } catch (err) {
-                            status.result = 'neutral';
-                            status.comment = err.message;
-                        }
-                    } catch (err) {
-                        if (err.rr) {
-                            rr = err.rr;
+                        status.result = crypto.verify(
+                            signatureHeader.signAlgo === 'rsa' ? signatureHeader.algorithm : null,
+                            signatureHeader.signAlgo === 'rsa' ? canonicalizedHeader : crypto.createHash('sha256').update(canonicalizedHeader).digest(),
+                            publicKey,
+                            Buffer.from(signatureHeader.parsed?.b?.value || '', 'base64')
+                        )
+                            ? 'pass'
+                            : 'fail';
+
+                        if (status.result === 'fail') {
+                            status.comment = 'bad signature';
                         }
 
-                        switch (err.code) {
-                            case 'ENOTFOUND':
-                            case 'ENODATA':
+                        if (status.result === 'pass') {
+                            if (signatureHeader.expiration && signatureHeader.timestamp && signatureHeader.expiration < signatureHeader.timestamp) {
                                 status.result = 'neutral';
-                                status.comment = `no key`;
-                                break;
-
-                            case 'EINVALIDVER':
-                                status.result = 'neutral';
-                                status.comment = `unknown key version`;
-                                break;
-
-                            case 'EINVALIDTYPE':
-                                status.result = 'neutral';
-                                status.comment = `unknown key type`;
-                                break;
+                                status.comment = 'invalid expiration';
+                            }
 
-                            case 'EINVALIDVAL':
+                            if (signatureHeader.expiration && signatureHeader.expiration < this.curTime) {
                                 status.result = 'neutral';
-                                status.comment = `invalid public key`;
-                                break;
-
-                            case 'ESHORTKEY':
-                                status.result = 'policy';
-                                if (!status.policy) {
-                                    status.policy = {};
-                                }
-                                status.policy['dkim-rules'] = `weak-key`;
-                                break;
-
-                            default:
-                                status.result = 'temperror';
-                                status.comment = `DNS failure: ${err.code || err.message}`;
+                                status.comment = 'expired';
+                            }
                         }
+                    } catch (err) {
+                        status.result = 'neutral';
+                        status.comment = err.message;
                     }
                 }
-
-                signatureHeader.bodyHashedBytes = this.bodyHashes.get(signatureHeader.bodyHashKey)?.bodyHashedBytes;
-                signatureHeader.canonicalizedLength = this.bodyHashes.get(signatureHeader.bodyHashKey)?.canonicalizedLength;
-                signatureHeader.sourceBodyLength = this.bodyHashes.get(signatureHeader.bodyHashKey)?.byteLength;
-
-                let result = {
-                    id: signatureHeader.parsed?.b?.value
-                        ? crypto.createHash('sha256').update(Buffer.from(signatureHeader.parsed?.b?.value, 'base64')).digest('hex')
-                        : crypto.randomUUID(),
-                    signingDomain: signatureHeader.signingDomain,
-                    selector: signatureHeader.selector,
-                    signature: signatureHeader.parsed?.b?.value,
-                    algo: signatureHeader.parsed?.a?.value,
-                    format: signatureHeader.parsed?.c?.value,
-                    bodyHash,
-                    bodyHashExpecting: signatureHeader.parsed?.bh?.value,
-                    signingHeaders,
-                    status,
-                    signTime: signatureHeader.timestamp ? signatureHeader.timestamp.toISOString() : null,
-                    expiresAfter: signatureHeader.expiration ? signatureHeader.expiration.toISOString() : null,
-                    signatureTimeValid: this.getSignatureTimeValid(signatureHeader)
-                };
-
-                if (typeof signatureHeader.sourceBodyLength === 'number') {
-                    result.sourceBodyLength = signatureHeader.sourceBodyLength;
-                }
-
-                if (typeof signatureHeader.bodyHashedBytes === 'number') {
-                    result.canonBodyLength = signatureHeader.bodyHashedBytes;
+            } catch (err) {
+                if (err.rr) {
+                    rr = err.rr;
                 }
 
-                if (typeof signatureHeader.canonicalizedLength === 'number') {
-                    result.canonBodyLengthTotal = signatureHeader.canonicalizedLength;
-                }
-
-                if (typeof signatureHeader.maxBodyLength === 'number') {
-                    result.canonBodyLengthLimited = true;
-                    result.canonBodyLengthLimit = signatureHeader.maxBodyLength;
-                    if (result.canonBodyLengthTotal > result.canonBodyLength) {
-                        status.underSized = result.canonBodyLengthTotal - result.canonBodyLength;
+                if (KEY_ERROR_COMMENTS.has(err.code)) {
+                    status.result = 'neutral';
+                    status.comment = KEY_ERROR_COMMENTS.get(err.code);
+                } else if (err.code === 'ESHORTKEY') {
+                    status.result = 'policy';
+                    if (!status.policy) {
+                        status.policy = {};
                     }
+                    status.policy['dkim-rules'] = `weak-key`;
                 } else {
-                    result.canonBodyLengthLimited = false;
+                    status.result = 'temperror';
+                    status.comment = `DNS failure: ${err.code || err.message}`;
                 }
+            }
+        }
 
-                if (typeof mimeStructureStart === 'number') {
-                    result.mimeStructureStart = mimeStructureStart;
-                }
+        if (warnings.length) {
+            // what the lenient mode accepted that the strict mode would not, never rendered
+            // into the Authentication-Results header
+            status.warnings = warnings;
+        }
 
-                if (publicKey) {
-                    result.publicKey = publicKey.toString();
-                }
+        const bodyHashedBytes = bodyHasher?.bodyHashedBytes;
+        const canonicalizedLength = bodyHasher?.canonicalizedLength;
+        const sourceBodyLength = bodyHasher?.byteLength;
 
-                if (modulusLength) {
-                    result.modulusLength = modulusLength;
-                }
+        if (!fallback) {
+            signatureHeader.bodyHashedBytes = bodyHashedBytes;
+            signatureHeader.canonicalizedLength = canonicalizedLength;
+            signatureHeader.sourceBodyLength = sourceBodyLength;
+        }
 
-                if (rr) {
-                    result.rr = rr;
-                }
+        let result = Object.assign(this.baseResult(signatureHeader, fallback ? canonicalization : signatureHeader.parsed?.c?.value), {
+            bodyHash,
+            bodyHashExpecting: signatureHeader.parsed?.bh?.value,
+            signingHeaders,
+            status,
+            signTime: signatureHeader.timestamp && !isNaN(signatureHeader.timestamp) ? signatureHeader.timestamp.toISOString() : null,
+            expiresAfter: signatureHeader.expiration && !isNaN(signatureHeader.expiration) ? signatureHeader.expiration.toISOString() : null,
+            signatureTimeValid: this.getSignatureTimeValid(signatureHeader)
+        });
+
+        if (typeof sourceBodyLength === 'number') {
+            result.sourceBodyLength = sourceBodyLength;
+        }
+
+        if (typeof bodyHashedBytes === 'number') {
+            result.canonBodyLength = bodyHashedBytes;
+        }
+
+        if (typeof canonicalizedLength === 'number') {
+            result.canonBodyLengthTotal = canonicalizedLength;
+        }
+
+        if (typeof signatureHeader.maxBodyLength === 'number') {
+            result.canonBodyLengthLimited = true;
+            result.canonBodyLengthLimit = signatureHeader.maxBodyLength;
+            if (result.canonBodyLengthTotal > result.canonBodyLength) {
+                status.underSized = result.canonBodyLengthTotal - result.canonBodyLength;
+            }
+        } else {
+            result.canonBodyLengthLimited = false;
+        }
+
+        if (typeof mimeStructureStart === 'number') {
+            result.mimeStructureStart = mimeStructureStart;
+        }
+
+        if (publicKey) {
+            result.publicKey = publicKey.toString();
+        }
+
+        if (modulusLength) {
+            result.modulusLength = modulusLength;
+        }
+
+        if (rr) {
+            result.rr = rr;
+        }
+
+        if (typeof result.status.comment === 'boolean') {
+            delete result.status.comment;
+        }
+
+        return result;
+    }
+
+    // A signature that could not be processed at all. The strict mode reports it as neutral
+    // (RFC 8601 section 2.7.1: "the signature or signatures contained syntax errors or were
+    // not otherwise able to be processed"), as "none" means that the message was not signed
+    skippedSignatureResult(signatureHeader) {
+        let status = {
+            result: 'neutral',
+            comment: signatureHeader.skip,
+            header: this.getStatusHeader(signatureHeader)
+        };
+
+        return Object.assign(this.baseResult(signatureHeader, signatureHeader.parsed?.c?.value), { status });
+    }
 
-                if (typeof result.status.comment === 'boolean') {
-                    delete result.status.comment;
+    async finalChunk() {
+        try {
+            if (!this.headers || (!this.bodyHashes.size && !this.signatureHeaders.some(signatureHeader => signatureHeader.invalid || signatureHeader.skip))) {
+                return;
+            }
+
+            // convert bodyHashes from hash objects to base64 strings
+            for (let [key, bodyHash] of this.bodyHashes.entries()) {
+                this.bodyHashes.get(key).hash = bodyHash.digest('base64');
+                this.bodyHashes.get(key).mimeStructureStart = bodyHash.getMimeStructureStart();
+            }
+
+            for (let signatureHeader of this.signatureHeaders) {
+                let result;
+
+                if (signatureHeader.skip) {
+                    if (!this.strict || signatureHeader.type !== 'DKIM') {
+                        // the lenient mode does not report what it can not process
+                        continue;
+                    }
+                    result = this.skippedSignatureResult(signatureHeader);
+                } else {
+                    result = await this.verifySignature(signatureHeader);
+
+                    if (signatureHeader.fallbackCanonicalization && !signatureHeader.invalid && result.status.result !== 'pass') {
+                        // only used when it verifies, the result of the default canonicalization
+                        // is kept otherwise. The key lookup is cached, so it is not repeated
+                        let fallbackResult = await this.verifySignature(signatureHeader, true);
+                        if (fallbackResult.status.result === 'pass') {
+                            fallbackResult.status.warnings = addWarning([].concat(fallbackResult.status.warnings || []), 'ams-c-default');
+                            result = fallbackResult;
+                        }
+                    }
                 }
 
                 switch (signatureHeader.type) {
                     case 'ARC':
-                        if (this.arc.lastEntry) {
-                            this.arc.lastEntry.messageSignature = result;
+                        if (!this.arc.lastEntry) {
+                            break;
                         }
+                        this.arc.lastEntry.messageSignature = result;
                         break;
                     case 'DKIM':
                     default:
@@ -422,7 +754,7 @@ class DkimVerifier extends MessageParser {
             }
 
             this.results.forEach(result => {
-                result.info = formatAuthHeaderRow('dkim', result.status);
+                result.info = formatAuthHeaderRow('dkim', result.status, { strict: this.strict });
             });
         }
 
@@ -432,4 +764,15 @@ class DkimVerifier extends MessageParser {
     }
 }
 
+// the body canonicalization of a c= value, 'simple' when it is not set (RFC 6376 section 3.5)
+const getBodyCanon = canonicalization => (canonicalization.split('/')[1] || 'simple').toLowerCase().trim();
+
+// the lower case header field names of an h= tag
+const normalizeFieldList = value =>
+    (value || '')
+        .toString()
+        .split(':')
+        .map(name => name.replace(/^[ \t\r\n]+|[ \t\r\n]+$/g, '').toLowerCase())
+        .filter(name => name);
+
 module.exports = { DkimVerifier };