Implemented: Add DKIM signing for outgoing SMTP mail (OFBIZ-13488) - #1612
Open
mridulpathak wants to merge 1 commit into
Open
Implemented: Add DKIM signing for outgoing SMTP mail (OFBIZ-13488)#1612mridulpathak wants to merge 1 commit into
mridulpathak wants to merge 1 commit into
Conversation
OFBiz's outgoing mail (EmailServices.sendMail) was never cryptographically signed, so receiving mail servers had no way to verify a message actually came from the sending domain. This adds DKIM (RFC 6376) signing via org.simplejavamail:utils-mail-dkim, hooked in right before the transport's sendMessage call -- the one place a message is finalized and handed to the wire. Signing config (domain, selector, PKCS#8 PEM private key, enabled flag) lives in a new MailDkimConfig entity, encrypted at rest, resolved inline in EmailServices (no separate resolver class, matching its existing style). Signing fails open for config/key errors -- a missing or invalid MailDkimConfig logs an error and sends the message unsigned rather than blocking mail -- though a write-time signing failure inside the transport's own send call still blocks the send, now with an accurate log message instead of a misleading connection-error one. A companion getDkimDnsRecord service derives the DNS TXT record value an admin needs to publish, from the same stored key, to avoid hand-computing the DKIM public key.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OFBiz's outgoing mail (EmailServices.sendMail) was never cryptographically signed, so receiving mail servers had no way to verify a message actually came from the sending domain. This adds DKIM (RFC 6376) signing via org.simplejavamail:utils-mail-dkim, hooked in right before the transport's sendMessage call. Signing config lives in a new MailDkimConfig entity (domain, selector, PKCS#8 PEM private key, enabled flag), encrypted at rest. Signing fails open on config/key errors -- a missing or invalid config sends the message unsigned rather than blocking mail. A companion getDkimDnsRecord service derives the DNS TXT record value an admin needs to publish, from the same stored key.