XF 2.3 Emails won't send

[My Dime Is Up]

Users have been reporting they aren't getting their OTP emails. After some DNS changes, the mail does send but will now always go to the spam folder. Using online email analyzers, it said that a DKIM record is invalid or not added at all, even though it is. I generated a DKIM in the email options of the Admin CP of XenForo and added it to our Cloudflare DNS records, and online DKIM checker tools say that "xenforo._domainkey" does return a valid DKIM, however when it comes to sending a test email, the DKIM signature is incorrect for some reason.

Here are the headers from the test email sent.

ARC-Authentication-Results: i=1; mx.google.com;
       dkim=neutral (body hash did not verify) header.i=@{XXXXX}.com header.s=xenforo header.b=fXj91kqT;
       spf=pass (google.com: domain of admin@{XXXXX}.com designates {IP ADDY} as permitted sender) smtp.mailfrom=admin@{XXXXX}.com;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from={XXXXX}.com

 

[ENF]

Let me suggest, run one of your emails through this service: https://www.learndmarc.com/ -- You send an email to their testing account from the domain you are having trouble with. This will go step by step to check the high level components. If all of this passes, then you could have other issues. DKIM testing is included here as well.

 

[My Dime Is Up]

Let me suggest, run one of your emails through this service: https://www.learndmarc.com/ -- You send an email to their testing account from the domain you are having trouble with. This will go step by step to check the high level components. If all of this passes, then you could have other issues. DKIM testing is included here as well.

I just updated the post because I never checked email headers. SPF and DMARC pass, but SKIM says the body hash did not verify. DNS is setup correctly, so I assume its a problem with XenForo signing the email? I'll send a test email to learndmarc and see what it says. Thanks for this!

 

[My Dime Is Up]

Let me suggest, run one of your emails through this service: https://www.learndmarc.com/ -- You send an email to their testing account from the domain you are having trouble with. This will go step by step to check the high level components. If all of this passes, then you could have other issues. DKIM testing is included here as well.

 

[ENF]

View attachment 325163
View attachment 325164

And you sent that from the forum mail system? Not an external client?

 

[My Dime Is Up]

And you sent that from the forum mail system? Not an external client?

Yes. I ran the "Test outbound email" function using PHP mail. The body hash doesn't match. DNS record is being fetched correctly, and XenForo is saying the DKIM is correct.

 

[ENF]

Yes. I ran the "Test outbound email" function using PHP mail. The body hash doesn't match. DNS record is being fetched correctly, and XenForo is saying the DKIM is correct.
View attachment 325165
View attachment 325166

Thanks. Don't have an immediate answer, but I'll test something on my end and come back with an update.

 

[ENF]

So, interestingly enough... I did a fresh configuration and got the same DKIM failure for some reason. All other configuration aspects were correct, but DKIM failed the check. This is xf 2.3.7 I'm working with btw...

DNS records were configured correctly
Xenforo gave green status and confirmed that it was signing emails.
The test tool recognized that DKIM was included but failed when validating against the public key in the DNS record.

Hmmm.

 

[My Dime Is Up]

So, interestingly enough... I did a fresh configuration and got the same DKIM failure for some reason. All other configuration aspects were correct, but DKIM failed the check. This is xf 2.3.7 I'm working with btw...

DNS records were configured correctly
Xenforo gave green status and confirmed that it was signing emails.
The test tool recognized that DKIM was included but failed when validating against the public key in the DNS record.

Hmmm.

Very interesting, maybe its a bug with 2.3.7? Emails don't seem to be going to spam anymore, but the headers still show that the body hash doesn't match. Maybe I should make a bug report if others are experiencing this same issue.

 

[ENF]

Very interesting, maybe its a bug with 2.3.7? Emails don't seem to be going to spam anymore, but the headers still show that the body hash doesn't match. Maybe I should make a bug report if others are experiencing this same issue.

I'm still working on this, just juggling this with other tasks. I just wanted to finish a test with two earlier versions and then I was going to update this thread. So, let me do that and I'll come back here in a bit.

 

[ENF]

Very interesting, maybe its a bug with 2.3.7? Emails don't seem to be going to spam anymore, but the headers still show that the body hash doesn't match. Maybe I should make a bug report if others are experiencing this same issue.

I went all the way back to 2.3.0 and even with a minimal, basic setup, the DKIM setup always causes this dkim=neutral (body hash did not verify) error. The DKIM signature is validated and by all design, should work normally. If I switch to a SMTP service handler with a different DKIM on their side, it works fine.

Not sure if this is actually a bug or we're missing something obvious where other people aren't getting these kind of results.

 

[ENF]

@Jeremy P or @Chris D even...

In regards to this DKIM email discussion above...


If I'm not mistaken, when you setup a DKIM record, this option data should reflect a privatekey value instead of 'false'.
Am I mistaken? And if not, any idea why a private key would not be set in this case?

I've looked at older site data in this same option field and there is a populated privatekey entry, exampled below:
{"enabled":true,"verified":true,"failed":false,"domain":"domaingoeshere.com","privateKey":"emailDkim-95ehkmLg-b.key"}

Thanks.