title: DKIM failing but can't find any problem with hashing or signing syntax
body: <p>I'm writing my own DKIM implementation in Node.js and I'm having a problem getting my DKIM to pass.</p>
  
  <p><em>Here is my mail body:</em></p>
  
  <p>dGVzdA==\r\n</p>
  
  <p><em>Here is the body hash (sha256):</em></p>
  
  <p>STFhz2ITzV8iSPWgLK0kfUa69jvk327MHRw2ZpGDvWE=</p>
  
  <p><em>Here is my dkim header hash input:</em></p>
  
  <p>from:test@test.test.org\r\ndkim-signature:v=1;a=rsa-sha256;c=relaxed;s=wo8vy2th;d=test.test.org;h=from;bh=STFhz2ITzV8iSPWgLK0kfUa69jvk327MHRw2ZpGDvWE=;b=</p>
  
  <p>I then sign that using this code:</p>
  
  <pre><code>crypto.createSign('rsa-sha256').update(headerHash).sign({key: processItem.sharedData.dkim_private_key, passphrase: dkimDomainKeyPassphrase}, 'base64');
  </code></pre>
  
  <p>Yet on arrival I get dkim=fail. 
  My DNS _domainkey does resolve correctly.</p>
  
  <p>Note for this example I am only using the From: header just to try to find the problem. In reality I will be using all the recommended headers.</p>
  
  <p>EDIT: here is the raw email source that is failing:</p>
  
  <pre><code>Delivered-To: wyatt5@ethereal.email
  Return-Path: &lt;test@test2.cybermancy.org&gt;
  Authentication-Results: mx.ethereal.email; spf=permerror smtp.mailfrom=test2.cybermancy.org; dkim=fail header.i=@test2.cybermancy.org
  Received-SPF: PermError (mx.ethereal.email: domain of test2.cybermancy.org does not designate 67.205.181.191 as permitted sender) receiver=mx.ethereal.email; identity=mailfrom; client-ip=67.205.181.191; helo=mta.postagent.io; envelope-from=&lt;test@test2.cybermancy.org&gt;
  Received-SPF: None (mx.ethereal.email: domain of mta.postagent.io does not designate 67.205.181.191 as permitted sender) receiver=mx.ethereal.email; identity=helo; client-ip=67.205.181.191; helo=mta.postagent.io; envelope-from=&lt;test@test2.cybermancy.org&gt;
  Received: from mta.postagent.io ([67.205.181.191])
      by mx.ethereal.email (Haraka/2.8.23) with ESMTP id A08331BF-93B5-41C1-ADBA-B7B0F9DEF1CF.1
      envelope-from &lt;test@test2.cybermancy.org&gt;;
      Fri, 17 Jan 2020 14:18:12 +0100
  Message-ID: &lt;23e18f92-e6f3-4fab-bfa3-649584bec5b4+1579267090958@mta.postagent.io&gt;
  DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; s=wo8vy2th;        
      h=mime-version:from:to:date:subject;        
      d=test2.cybermancy.org;        
      bh=STFhz2ITzV8iSPWgLK0kfUa69jvk327MHRw2ZpGDvWE=;        
      b=RH/CNjqKlOcLEuwT8zCEo2k0UyDDAlCfsEVkPBU83pbNNDNxVMUVDQmHsxjPUw/GLm0osY948u1YhUIC8clAfUdaaVQqHfWXDmuk24t+uaeHLwQu/dTRuLJfFjO+lXlnx4VFNxQHj3kBAWJ6/aNhO5kq3QI7u7uGWtGf+4pZzg8=
  To: wyatt5@ethereal.email
  From: test@test2.cybermancy.org
  Subject: test subject
  Date: Fri, 17 Jan 2020 13:18:10 +0000
  X-report-abuse: Please forward a copy of this message, including all headers, to abuse@test.org
  Mime-Version: 1.0
  Content-Type: text/plain; charset="UTF-8"
  Content-Transfer-Encoding: base64
  
  dGVzdA==
  </code></pre>
  
  <p>Note: I have tried the signature value with folding and without. For this example I did not fold it.</p>
  
  <p>Here is my header hash input:</p>
  
  <pre><code>mime-version:1.0\\r\\nfrom:test@test2.cybermancy.org\r\nto:wyatt5@ethereal.email\r\ndate:Fri, 17 Jan 2020 13:18:10 +0000\r\nsubject:test subject\r\ndkim-signature:v=1;a=rsa-sha256;c=relaxed;s=wo8vy2th;d=test2.cybermancy.org;h=mime-version:from:to:date:subject;bh=STFhz2ITzV8iSPWgLK0kfUa69jvk327MHRw2ZpGDvWE=;b=
  </code></pre>
  
  <p>DKIM selector: wo8vy2th
  DKIM public key at wo8vy2th._domainkey.test2.cybermancy.org</p>
  
  <pre><code>k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7V0yupUNowYt7ciprmmn3s2sQkQA8cI7LVywrTwAOAS1RMAAcPRGIO0By/XHlh8uTMf0Kw+GscrHRz90TUJpRdDx9lCKCwUE6taWVsdsgUPmpJ1AxHDCrmbadFdjsc0hNTCt8niNsmph8qiV/6T6Qjtt/4piVlxKxzLPIJn976QIDAQAB
  </code></pre>
  
  <p>EDIT 2:</p>
  
  <p>Here is my private key as printed with JSON.stringify():</p>
  
  <pre><code>"-----BEGIN ENCRYPTED PRIVATE KEY-----\nMIIC3TBXBgkqhkiG9w0BBQ0wSjApBgkqhkiG9w0BBQwwHAQIb03M5gGl7LECAggA\nMAwGCCqGSIb3DQIJBQAwHQYJYIZIAWUDBAEqBBCag7vzzjSCpDbgd9m2qci1BIIC\ngF2BIPWvOYMREJcbfs8JF3TAyUsuY6rXjW4ff3GPNqOHw8k45JCejSwOpHA1xgK8\n1jLVHf8kdhjCPqw9S9+l6GT59VXQqmFXKte5gTSwgOHz1Vy+fsH7OLZpPlxAhDFX\nXoyGBLAOnRUQ25Jl9eSEZ2Zs20L0Qd0XJL3MITWzTmHql+MpnZFkNW9mRZuhJ//j\nWmjJ7MTmDe6dhG5CYs2wS8cYET4z9tltDVBk287gwyMzg9dNdvbu2vvihvjiN3r6\ndYwH81ILDUoi6TFZeItjZVRk1wrDXemDhP4WWtWYA5fIMW/DDXjWSlja6aytfSAy\nzcZJMDYKhu8XGBYffFoG/3vP4Nbv8J9+XlQ0Av9LnHG1OjDpdFAaYOgwl7Cv2lWt\n0agNFrsaVgU4lkuBF9UMJp9QySsRmSb/pIIpUp/KvA7GpSmRyXc+MGgOMdekh+Tp\n52i+0y/2DYMrlfCRiLu5mOs5Ks6UN5W80TBQdwnB+vM2/0DYkemQCocQqdmc0aZB\nvGnsriqbmhZLbHL79DlqFyJ+HB5j8WzjNUHO+LF2aBAbu92y2t6P6BDBlzsauu0D\ndvdiMiLh7ifzIkWWHsGMGng5FM+xsv/fQIZNDjjCT1Anb29BywneFZjBc0cghvw7\nbqAnwO4HJLXocDQIfWu9gmjsjodLfTzPBS622Qnu1J0HXMvasY7IBopVWfKncT6u\nkzd68EN0QyPeWgh3wQTOpwoakjTsorIGJ+Ph+AhemH3V1jhQchjtPbxxqU7QU1NG\nQBZn/YPkiQYSk23G5QbYdHNzOrTMI9DGsdqukArUo+HMv2viTbRDqPcEa3MEd0Rq\n67kB7QutXMLsv/S36UioBbg=\n-----END ENCRYPTED PRIVATE KEY-----\n"
  </code></pre>
  
  <p>The encrypted private key's password is:</p>
  
  <p>nkwsrcdk7gaah4vl7h0fdd1xjssefyibtyftyfjd98ewjmfnkisjt5t5jjjdfghgfdsrtyurtyu</p>