verify() function doesn't differentiate between invalid and not present

If you can provide a patch, I'll consider it, but I'm concerned that if it's too complex it might cause more maintenance overhead than it's worth.

Scott K

I've never made a patch before and I am rather new to Python so I'm not sure how that works, but this is what the new function would look like

  #: Checks if any DKIM signature is present
  #: @return: True if there is one or more DKIM signatures present or False otherwise
  def present(self):
    return (len([(x,y)] for x,y in self.headers if x.lower() == b"dkim-signature"]) > 0)

This function is a part of the dkim class (I put it just above the verify function. For reference here is how I call it:

message = *INSERT MESSAGE HERE*
d = dkim.DKIM(message)
present = d.present()
verify = d.verify()

I did have issues when trying to do "present = dkim.present(message)" so it seems I'm missing something (Claims module 'dkim' has no attribute 'present')

OK. I see what you're after and I don't think it would be a maintenance burden. I am somewhat reluctant because it seems to invite behavior that's contrary to a SHOULD NOT requirement from the DKIM RFC (Section 6.1):

   Survivability of signatures after transit is not guaranteed, and
   signatures can fail to verify through no fault of the Signer.
   Therefore, a Verifier SHOULD NOT treat a message that has one or more
   bad signatures and no good signatures differently from a message with
   no signature at all

https://tools.ietf.org/html/rfc6376

What's the use case?

Scott K

I'm making an email filter that sits at the user's firewall and decides, based on user-defined settings and different checks, which emails get received and which ones get destroyed. The end goal is attempting to remove as many malicious emails as possible while keeping as many legitimate emails as possible. There are multiple layers to this program to check validity and one of them is the dkim checker. Some of the settings can change the dkim checker behaviour, for example we can make it so only verify() is run (The no signatures case will be treated the same as invalid signatures) or we can run present() and treat them differently. These options are controlled by the user. Also note we will be applying weightings, just because an email has an invalid dkim signature doesn't mean we will instantly reject it. We consider all the layers before deciding.

I understand the reasoning for that SHOULD NOT requirement with packets dropping/corrupting and such, but we specifically need to have the option to differentiate between the two cases.

Thanks Scott Kitterman, that solved my question.