Skip to content

DKIM2: document draft -06 and the behavior changes of SparkPost/Momentum#1705 - #872

Open
juliebin wants to merge 3 commits into
mainfrom
1705-libdkim2
Open

juliebin wants to merge 3 commits into
mainfrom
1705-libdkim2

Conversation

@juliebin

@juliebin juliebin commented Oct 8, 2026 •

Copy link
Copy Markdown
Contributor

Documents two Momentum changes to the experimental DKIM2 module:

  • SparkPost/Momentum#1651 (PR SparkPost/Momentum#1706, merged): draft -06, and the on_recipe_key_case and on_bad_hash_algorithm options.
  • SparkPost/Momentum#1705 (PR SparkPost/Momentum#1729): the behavior changes of the new signing and verification engine, covering the verify() result, Authentication-Results, sign() failures and chain breaks, require_recipe and reject_body_redaction, key checks, option type checks and logging.

The 5.3.1 changelog gets a row for each. It also gets the rows for SparkPost/Momentum#1678 and #1683.

🤖 Generated with Claude Code


Note

Low Risk
Documentation-only; no runtime code changes, though it describes breaking DKIM2 Lua API and wire-compat changes operators must plan for on upgrade.

Overview
Updates Momentum DKIM2 and 5.3.1 docs to match draft -06 and the 5.3.1 signing/verification engine (I-1651, I-1705), plus SMTP relay fixes (I-1678, I-1683) in the changelog.

DKIM2 reference pages (dkim2/*.md) are rewritten around breaking operator/API changes: verify() now cryptographically checks every hop with a new result shape (problems, ar, per-sig sets, renamed reason codes, dsn_prohibited); ar_clauses() is driven by result.ar with draft-style reason= and quoted header.s/mf/rt. Signing documents require_recipe (replacing allow_missing_recipe), default {"b":null} when content changed without a recipe, third-value refusal on failed sign(), stricter chain-break rules, and Ed25519 p= / RSA size / sig_partial behavior. Overview drops several old “known limitations” (e.g. Received-SPF, highest-only crypto) and points debug/reasons to the updated verify page.

Adds content/momentum/changelog/5/5-3-1.md and links it from navigation.yml and the 5.x changelog index.

Reviewed by Cursor Bugbot for commit 101f459. Bugbot is set up for automated code reviews on this repo. Configure here.

@netlify

netlify Bot commented Oct 8, 2026 •

Copy link
Copy Markdown

✅ Deploy Preview for support-docs ready!

Name Link
🔨 Latest commit 101f459
🔍 Latest deploy log https://app.netlify.com/projects/support-docs/deploys/6ac7e5ab2e329200080ae043
😎 Deploy Preview https://deploy-preview-872--support-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Comment thread content/momentum/4/dkim2/debug.md Outdated
| `error` | Errors, such as a `sign()` whose key cannot be read. **Default.** |
| `warning` | Adds a key lookup that fails or returns a resolver error other than NXDOMAIN; a verification that stops at a limit; a `sign()` that signs with `f=exploded` although an earlier signature asked for `f=donotexplode`; and a `sign()` that signs over two fields claiming the same `i=` or the same `m=`. |
| `info` | Adds, for each key looked up in DNS, a line naming the TXT record and a line with the answer; the verdict of each `verify()` with its reason (for example `body_hash_mismatch`); a line for each `sign()` that adds fields; and each refusal by `sign()`, including one it then signs over, bridges or skips. |
| `debug` | Nothing beyond `info`. |

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it worth mentioning debug, then?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 101f459. The table now lists only the levels that add lines for DKIM2.

@juliebin
juliebin requested a review from dkoerichbird October 8, 2026 18:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants