panel-dkim-signing stage 1: the panel's DKIM signer, beside OpenDKIM

internal/milter/sign.go: a milter on two sockets (cmd/panel/signer.go): sign.sock for 465/587, the key of the domain the SASL login belongs to (Bindings.DomainOf, the sender_login_maps Postfix reads), and sign-local.sock for the panel's own sendmail(1) mail, the server's name. go-msgauth/dkim v0.7.0, relaxed/simple, OpenDKIM's dkim_should_signhdrs[] (libopendkim/dkim.c:223-246) in message order plus From once more; keys and selectors from the KeyTable the panel writes, a key path outside the key directory refused; strict - whatever cannot be signed is deferred. From the sources: Postfix 3.10.13 milter8.c:2329-2400 hands a folded header \n-separated, so the signer joins its lines with CRLF; inserts are 1-based in cleanup_ins_header() (cleanup_milter.c:1193), so index 0 is the top, where OpenDKIM puts its own (opendkim.c:3673). go-milter v0.4.1 calls no Abort when a connection ends, so a watchdog closes go-msgauth's streaming signer after an hour and a late end of message is deferred. Postfix: smtpd_milters = sender check, signer, OpenDKIM, journal; non_smtpd_milters = the signer's local socket, OpenDKIM - both sign every message until stage 2. disable_mime_output_conversion=yes (default off, mail_params.h:3088): an 8-bit message is no longer re-encoded after it is signed. Tests: unit tests sign and verify folded, tab-led and space-free headers, an added From:, a changed body, two messages on a connection, odd bodies, and five cases deferred. e2e: the sink image has python3-dkim (dkimpy 1.1.8-2) and the stand's DNS; on an application's message and on a notification the two signatures must agree on h=, bh=, c=, s=, a= and each must pass dkimverify. On the server: make e2e exit 0 (714 s), go vet + go test 27 packages ok. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-15 23:49:14 +03:00
parent a07ba5776c
commit 14de9a05c8
15 changed files with 924 additions and 37 deletions
@@ -0,0 +1,388 @@
+package milter
+
+// The DKIM signer (docs/plans/panel-dkim-signing.md): the panel's own milter
+// that signs what applications send on 465/587 with the key of the domain
+// their login belongs to, and what the panel itself sends with the key of
+// the server's name. Each of the two is a socket of its own, so the socket a
+// message comes through - not the absence of a login - decides that the
+// server's key may sign it (Q1 of the plan).
+
+import (
+	"context"
+	"crypto"
+	"crypto/x509"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"log"
+	"net"
+	"net/textproto"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/emersion/go-milter"
+	"github.com/emersion/go-msgauth/dkim"
+)
+
+// signHeaders is the set of header names signed when present: OpenDKIM's
+// dkim_should_signhdrs[], RFC 6376 § 5.4.1's list (OpenDKIM 2.11.0~beta2,
+// libopendkim/dkim.c:223-246), which OpenDKIM signed with until now. Every
+// occurrence is signed, in message order, and From once more (signLines).
+var signHeaders = map[string]bool{
+	"from": true, "reply-to": true, "subject": true, "date": true, "to": true, "cc": true,
+	"resent-date": true, "resent-from": true, "resent-sender": true, "resent-to": true, "resent-cc": true,
+	"in-reply-to": true, "references": true,
+	"list-id": true, "list-help": true, "list-unsubscribe": true, "list-subscribe": true,
+	"list-post": true, "list-owner": true, "list-archive": true,
+}
+
+// signLimit bounds how long a message may take from the end of its headers
+// to its end. go-milter v0.4.1 tells a session nothing when its connection
+// ends early (session.go, HandleMilterCommands(): it returns on EOF or QUIT
+// without calling Abort), and go-msgauth's signer reads the message in a
+// goroutine of its own (dkim/sign.go, NewSigner(): an io.Pipe), which would
+// wait for the rest for ever. At the limit the signer is closed and a message
+// that does go on is deferred, never signed over part of its body. An hour is
+// far above Postfix's own bounds on a transaction.
+const signLimit = time.Hour
+
+// SignKeys reads the domains the server signs for, their selectors and key
+// files from the KeyTable the panel writes (internal/domain, renderTables():
+// "<domain> <domain>:<selector>:<keysDir>/<domain>/<selector>.private"), the
+// table OpenDKIM reads too until it leaves the image. A key file is read
+// when it changes, and only from under keysDir.
+type SignKeys struct {
+	table, keysDir string
+
+	mu    sync.Mutex
+	stamp fileStamp
+	rows  map[string]keyRow
+	keys  map[string]loadedKey
+}
+
+type keyRow struct{ selector, path string }
+
+type loadedKey struct {
+	stamp  fileStamp
+	signer crypto.Signer
+}
+
+// fileStamp tells a file's versions apart: the panel replaces a table or a
+// key by writing a new file and renaming it over the old one
+// (internal/atomicfile), so a new version is a new modification time or
+// size.
+type fileStamp struct {
+	mod  time.Time
+	size int64
+}
+
+func stampOf(fi os.FileInfo) fileStamp { return fileStamp{fi.ModTime(), fi.Size()} }
+
+// errNoKey is a domain the KeyTable has no line for.
+var errNoKey = errors.New("no signing key")
+
+// NewSignKeys reads keyTable; keysDir is the directory every key in it must
+// be under.
+func NewSignKeys(keyTable, keysDir string) *SignKeys {
+	return &SignKeys{table: keyTable, keysDir: keysDir, keys: map[string]loadedKey{}}
+}
+
+// Lookup gives the selector and key of domain.
+func (k *SignKeys) Lookup(domain string) (string, crypto.Signer, error) {
+	domain = strings.ToLower(domain)
+	k.mu.Lock()
+	defer k.mu.Unlock()
+	if err := k.readTable(); err != nil {
+		return "", nil, err
+	}
+	row, ok := k.rows[domain]
+	if !ok {
+		return "", nil, fmt.Errorf("%w for %s", errNoKey, domain)
+	}
+	fi, err := os.Stat(row.path)
+	if err != nil {
+		return "", nil, fmt.Errorf("key of %s: %w", domain, err)
+	}
+	if have, ok := k.keys[row.path]; ok && have.stamp == stampOf(fi) {
+		return row.selector, have.signer, nil
+	}
+	signer, err := readKey(row.path)
+	if err != nil {
+		return "", nil, fmt.Errorf("key of %s: %w", domain, err)
+	}
+	k.keys[row.path] = loadedKey{stampOf(fi), signer}
+	return row.selector, signer, nil
+}
+
+func (k *SignKeys) readTable() error {
+	fi, err := os.Stat(k.table)
+	if err != nil {
+		return fmt.Errorf("key table: %w", err)
+	}
+	if k.rows != nil && k.stamp == stampOf(fi) {
+		return nil
+	}
+	data, err := os.ReadFile(k.table)
+	if err != nil {
+		return fmt.Errorf("key table: %w", err)
+	}
+	rows := map[string]keyRow{}
+	for n, line := range strings.Split(string(data), "\n") {
+		if strings.TrimSpace(line) == "" {
+			continue
+		}
+		name, value, ok := strings.Cut(line, " ")
+		// Domain and selector never hold a colon (internal/domain,
+		// opendkimForbidden); the path takes the rest.
+		parts := strings.SplitN(value, ":", 3)
+		if !ok || len(parts) != 3 || !strings.EqualFold(parts[0], name) {
+			return fmt.Errorf("key table: line %d is not \"<domain> <domain>:<selector>:<path>\"", n+1)
+		}
+		domain, selector, path := strings.ToLower(name), parts[1], parts[2]
+		// The panel writes exactly this path (renderTables); anything else
+		// is not read.
+		if want := filepath.Join(k.keysDir, domain, selector+".private"); filepath.Clean(path) != want {
+			return fmt.Errorf("key table: line %d names %s, not %s", n+1, path, want)
+		}
+		rows[domain] = keyRow{selector, path}
+	}
+	k.rows, k.stamp = rows, stampOf(fi)
+	return nil
+}
+
+// readKey reads a PEM private key: PKCS#1 as internal/domain writes it
+// (dkim.go, writePrivateKeyPEM()), PKCS#8 as well.
+func readKey(path string) (crypto.Signer, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+	block, _ := pem.Decode(data)
+	if block == nil {
+		return nil, errors.New("no PEM block")
+	}
+	if key, err := x509.ParsePKCS1PrivateKey(block.Bytes); err == nil {
+		return key, nil
+	}
+	key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
+	if err != nil {
+		return nil, fmt.Errorf("not an RSA or PKCS#8 key: %w", err)
+	}
+	signer, ok := key.(crypto.Signer)
+	if !ok {
+		return nil, fmt.Errorf("key type %T cannot sign", key)
+	}
+	return signer, nil
+}
+
+// signSession is one connection of a signer socket.
+type signSession struct {
+	milter.NoOpMilter
+	keys *SignKeys
+	// domainOf gives the domain whose key signs the message: the login's on
+	// the applications' socket, the server's name on the panel's own.
+	domainOf func(login string) string
+
+	login   string
+	headers []field
+	signer  *dkim.Signer
+	domain  string
+	expired chan struct{} // closed by the watchdog at signLimit
+	done    chan struct{} // closed when the message ends, to stop it
+}
+
+type field struct{ name, value string }
+
+func (s *signSession) reset() {
+	if s.signer != nil {
+		close(s.done)
+		_ = s.signer.Close()
+	}
+	s.login, s.headers, s.signer, s.domain = "", nil, nil, ""
+}
+
+// MailFrom starts a message. {auth_authen} is the SASL login (see
+// session.MailFrom in milter.go for the macro list Postfix sends).
+func (s *signSession) MailFrom(from string, m *milter.Modifier) (milter.Response, error) {
+	s.reset()
+	s.login = macro(m, "auth_authen")
+	return milter.RespContinue, nil
+}
+
+// Header keeps every header as Postfix hands it over. Postfix 3.10.13,
+// src/milter/milter8.c:2329-2400, milter8_header(): the value with its leading
+// white space, for a milter that asks for it (OptHeaderLeadingSpace,
+// ServeSign); a header of several lines as text separated by "\n"; and not
+// Postfix's own Received:, which goes above the signature anyway (an
+// inserted header is placed relative to the message as delivered).
+func (s *signSession) Header(name, value string, m *milter.Modifier) (milter.Response, error) {
+	s.headers = append(s.headers, field{name, value})
+	return milter.RespContinue, nil
+}
+
+// Headers chooses the key and starts the signer with the header block.
+// What cannot be signed is deferred: the socket is attached with
+// default_action=tempfail, and so is every refusal here.
+//
+// h is not read: go-milter v0.4.1 keeps every header of the connection in it
+// (see senderSession.Headers).
+func (s *signSession) Headers(h textproto.MIMEHeader, m *milter.Modifier) (milter.Response, error) {
+	s.domain = s.domainOf(s.login)
+	if s.domain == "" {
+		log.Printf("dkim-signer: no sending domain for login %q - deferring", s.login)
+		return milter.RespTempFail, nil
+	}
+	selector, key, err := s.keys.Lookup(s.domain)
+	if err != nil {
+		log.Printf("dkim-signer: %v - deferring", err)
+		return milter.RespTempFail, nil
+	}
+	keys, block := signLines(s.headers)
+	signer, err := dkim.NewSigner(&dkim.SignOptions{
+		Domain:                 s.domain,
+		Selector:               selector,
+		Signer:                 key,
+		HeaderCanonicalization: dkim.CanonicalizationRelaxed,
+		BodyCanonicalization:   dkim.CanonicalizationSimple,
+		HeaderKeys:             keys,
+	})
+	if err != nil {
+		log.Printf("dkim-signer: %s: %v - deferring", s.domain, err)
+		return milter.RespTempFail, nil
+	}
+	s.signer, s.expired, s.done = signer, make(chan struct{}), make(chan struct{})
+	go watch(signer, s.expired, s.done)
+	if _, err := signer.Write(block); err != nil {
+		log.Printf("dkim-signer: %s: %v - deferring", s.domain, err)
+		s.reset()
+		return milter.RespTempFail, nil
+	}
+	return milter.RespContinue, nil
+}
+
+// watch closes signer at signLimit unless done is closed first.
+func watch(signer *dkim.Signer, expired, done chan struct{}) {
+	t := time.NewTimer(signLimit)
+	defer t.Stop()
+	select {
+	case <-done:
+	case <-t.C:
+		close(expired)
+		_ = signer.Close()
+	}
+}
+
+// signLines is the header block the signer reads and the names it signs.
+// Each header is written as Postfix will deliver it: the name, the colon, the
+// value with its own leading white space, the lines of a folded value joined
+// with CRLF; and the empty line that ends the block. The names: every header
+// in signHeaders, in message order, and From once more, so that a From:
+// added later breaks the signature (RFC 6376 § 5.4.2; OversignHeaders From in
+// OpenDKIM's configuration until now; go-msgauth v0.7.0, dkim/sign.go,
+// NewSigner(): a name with no instance left is kept in h= and hashes
+// nothing).
+func signLines(headers []field) ([]string, []byte) {
+	var keys []string
+	var b strings.Builder
+	for _, f := range headers {
+		b.WriteString(f.name)
+		b.WriteString(":")
+		b.WriteString(strings.ReplaceAll(strings.ReplaceAll(f.value, "\r\n", "\n"), "\n", "\r\n"))
+		b.WriteString("\r\n")
+		if signHeaders[strings.ToLower(strings.TrimSpace(f.name))] {
+			keys = append(keys, strings.TrimSpace(f.name))
+		}
+	}
+	b.WriteString("\r\n")
+	return append(keys, "From"), []byte(b.String())
+}
+
+// BodyChunk hashes the body as it comes. Postfix 3.10.13,
+// src/milter/milter8.c:2470-2500, milter8_body(): every line ends "\r\n".
+func (s *signSession) BodyChunk(chunk []byte, m *milter.Modifier) (milter.Response, error) {
+	if s.signer == nil {
+		return milter.RespContinue, nil
+	}
+	if _, err := s.signer.Write(chunk); err != nil {
+		log.Printf("dkim-signer: %s: %v - deferring", s.domain, err)
+		s.reset()
+		return milter.RespTempFail, nil
+	}
+	return milter.RespContinue, nil
+}
+
+// Body is the end of the message: the signature goes in at the top, where
+// OpenDKIM put it (opendkim/opendkim.c:3673, dkimf_insheader(ctx, 0, ...)).
+// Postfix 3.10.13, src/milter/milter8.c:1445-1465, SMFIR_INSHEADER: the
+// index is passed on plus one; src/cleanup/cleanup_milter.c:1193,
+// cleanup_ins_header(): "Index 1 is the top-most header" - above Postfix's
+// own Received:, which a milter never sees (milter8.c:2352-2358, "insert
+// requests are relative to the message as delivered"). go-milter v0.4.1,
+// modifier.go, InsertHeader() turns the folded value's CRLF into LF, as
+// Postfix keeps a header.
+func (s *signSession) Body(m *milter.Modifier) (milter.Response, error) {
+	signer := s.signer
+	if signer == nil {
+		// Headers did not start one, and answered tempfail already.
+		return milter.RespTempFail, nil
+	}
+	close(s.done)
+	s.signer = nil
+	err := signer.Close()
+	select {
+	case <-s.expired:
+		err = fmt.Errorf("the message took longer than %s", signLimit)
+	default:
+	}
+	if err != nil {
+		log.Printf("dkim-signer: %s: %v - deferring", s.domain, err)
+		return milter.RespTempFail, nil
+	}
+	name, value, ok := strings.Cut(signer.Signature(), ": ")
+	if !ok || !strings.EqualFold(name, "DKIM-Signature") {
+		log.Printf("dkim-signer: %s: malformed signature from the library - deferring", s.domain)
+		return milter.RespTempFail, nil
+	}
+	if err := m.InsertHeader(0, name, strings.TrimSuffix(value, "\r\n")); err != nil {
+		return nil, err
+	}
+	return milter.RespContinue, nil
+}
+
+func (s *signSession) Abort(m *milter.Modifier) error {
+	s.reset()
+	return nil
+}
+
+// ServeSign runs a signer on ln until ctx is cancelled; domainOf chooses the
+// key of each message (signSession.domainOf).
+//
+// The protocol: headers with their leading space (as for the sender check,
+// ServeSender) and the body. The milter says it adds headers (go-milter
+// v0.4.1, milter.go: OptAddHeader is SMFIF_ADDHDRS), as the protocol asks of
+// one that does; Postfix 3.10.13 does not hold an insert request against it
+// (src/milter/milter8.c:1445-1465 reads SMFIR_INSHEADER without looking at
+// the flag).
+func ServeSign(ctx context.Context, ln net.Listener, keys *SignKeys, domainOf func(login string) string) error {
+	srv := &milter.Server{
+		NewMilter: func() milter.Milter {
+			return &signSession{keys: keys, domainOf: domainOf}
+		},
+		Actions:  milter.OptAddHeader,
+		Protocol: milter.OptHeaderLeadingSpace,
+	}
+	go func() {
+		<-ctx.Done()
+		_ = srv.Close()
+	}()
+	if err := srv.Serve(ln); err != nil {
+		if ctx.Err() != nil {
+			return nil
+		}
+		return err
+	}
+	return nil
+}
@@ -0,0 +1,302 @@
+package milter
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/pem"
+	"net"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/emersion/go-milter"
+	"github.com/emersion/go-msgauth/dkim"
+)
+
+// signFixture is a key directory and KeyTable laid out as internal/domain
+// writes them (renderTables(), writePrivateKeyPEM(): PKCS#1 PEM) for
+// example.org with selector sel, and the DNS record of the key.
+type signFixture struct {
+	dir, table, keysDir string
+	record              string
+}
+
+func newSignFixture(t *testing.T) signFixture {
+	t.Helper()
+	dir := t.TempDir()
+	keysDir := filepath.Join(dir, "keys")
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatal(err)
+	}
+	keyPath := filepath.Join(keysDir, "example.org", "sel.private")
+	if err := os.MkdirAll(filepath.Dir(keyPath), 0o750); err != nil {
+		t.Fatal(err)
+	}
+	pemBytes := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)})
+	if err := os.WriteFile(keyPath, pemBytes, 0o640); err != nil {
+		t.Fatal(err)
+	}
+	table := filepath.Join(dir, "KeyTable")
+	if err := os.WriteFile(table, []byte("example.org example.org:sel:"+keyPath+"\n"), 0o640); err != nil {
+		t.Fatal(err)
+	}
+	pub, err := x509.MarshalPKIXPublicKey(&key.PublicKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return signFixture{dir, table, keysDir, "v=DKIM1; k=rsa; p=" + base64.StdEncoding.EncodeToString(pub)}
+}
+
+// startSigner serves a signer whose logins map by domains and returns a
+// session of go-milter's client on it.
+func startSigner(t *testing.T, f signFixture, domainOf func(string) string) *milter.ClientSession {
+	t.Helper()
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	go ServeSign(ctx, ln, NewSignKeys(f.table, f.keysDir), domainOf)
+	// The library's server speaks milter version 2; the client asks for no
+	// action only version 6 has (see TestRecipientsThroughGoMilter).
+	cl := milter.NewClientWithOptions("tcp", ln.Addr().String(), milter.ClientOptions{
+		ActionMask: milter.OptAddHeader | milter.OptChangeHeader,
+	})
+	t.Cleanup(func() { cl.Close() })
+	s, err := cl.Session()
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { s.Close() })
+	return s
+}
+
+func appDomains(login string) string {
+	if login == "app1" {
+		return "example.org"
+	}
+	return ""
+}
+
+// The headers of a test message as Postfix hands them to a milter that asks
+// for the leading space: the value after the colon, a folded one with "\n"
+// between its lines (Postfix 3.10.13, src/milter/milter8.c:2329-2400,
+// milter8_header()). Composed from that source, not seen on a stand.
+var testHeaders = []field{
+	{"From", " Alice <alice@example.org>"},
+	{"To", " bob@example.net"},
+	{"Subject", " a subject that is\n\tfolded over two lines"},
+	{"Date", " Thu, 15 Oct 2026 20:00:00 +0000"},
+	{"Message-ID", " <1@example.org>"},
+	{"X-Mailer", "no space after the colon"},
+}
+
+const testBody = "Hello,\r\n\r\nthe body, with a blank line in it.\r\n"
+
+// sendMessage runs one message through s and returns the modifications
+// asked for at its end and the final action.
+func sendMessage(t *testing.T, s *milter.ClientSession, login string, headers []field, body string) ([]milter.ModifyAction, *milter.Action) {
+	t.Helper()
+	if err := s.Macros(milter.CodeMail, "{auth_authen}", login); err != nil {
+		t.Fatal(err)
+	}
+	if act, err := s.Mail("<alice@example.org>", nil); err != nil || act.Code != milter.ActContinue {
+		t.Fatalf("mail: %+v %v", act, err)
+	}
+	if act, err := s.Rcpt("<bob@example.net>", nil); err != nil || act.Code != milter.ActContinue {
+		t.Fatalf("rcpt: %+v %v", act, err)
+	}
+	for _, h := range headers {
+		if act, err := s.HeaderField(h.name, h.value); err != nil || act.Code != milter.ActContinue {
+			t.Fatalf("header %s: %+v %v", h.name, act, err)
+		}
+	}
+	act, err := s.HeaderEnd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if act.Code != milter.ActContinue {
+		return nil, act
+	}
+	if act, err := s.BodyChunk([]byte(body)); err != nil || act.Code != milter.ActContinue {
+		t.Fatalf("body: %+v %v", act, err)
+	}
+	mods, act, err := s.End()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return mods, act
+}
+
+// delivered is the message as Postfix delivers it with the signature
+// inserted at the top: every header line ending CRLF.
+func delivered(sig milter.ModifyAction, headers []field, body string) []byte {
+	var b bytes.Buffer
+	crlf := func(v string) string { return strings.ReplaceAll(v, "\n", "\r\n") }
+	b.WriteString(sig.HeaderName + ": " + crlf(sig.HeaderValue) + "\r\n")
+	for _, h := range headers {
+		b.WriteString(h.name + ":" + crlf(h.value) + "\r\n")
+	}
+	b.WriteString("\r\n" + body)
+	return b.Bytes()
+}
+
+func verifyWith(t *testing.T, record string, msg []byte) *dkim.Verification {
+	t.Helper()
+	vs, err := dkim.VerifyWithOptions(bytes.NewReader(msg), &dkim.VerifyOptions{
+		LookupTXT: func(string) ([]string, error) { return []string{record}, nil },
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(vs) != 1 {
+		t.Fatalf("%d signatures, want 1", len(vs))
+	}
+	return vs[0]
+}
+
+// signed sends one message and returns the signature the signer inserted.
+func signed(t *testing.T, s *milter.ClientSession, login string, headers []field, body string) milter.ModifyAction {
+	t.Helper()
+	mods, act := sendMessage(t, s, login, headers, body)
+	if act.Code != milter.ActContinue {
+		t.Fatalf("end of message: %+v, want continue", act)
+	}
+	if len(mods) != 1 || mods[0].Code != milter.ActInsertHeader || mods[0].HeaderIndex != 0 || mods[0].HeaderName != "DKIM-Signature" {
+		t.Fatalf("modifications %+v, want one DKIM-Signature inserted at 0", mods)
+	}
+	return mods[0]
+}
+
+func TestSignerSignsWithTheLoginsDomain(t *testing.T) {
+	f := newSignFixture(t)
+	s := startSigner(t, f, appDomains)
+	sig := signed(t, s, "app1", testHeaders, testBody)
+
+	v := verifyWith(t, f.record, delivered(sig, testHeaders, testBody))
+	if v.Err != nil {
+		t.Fatalf("signature does not verify: %v\n%s", v.Err, delivered(sig, testHeaders, testBody))
+	}
+	if v.Domain != "example.org" {
+		t.Errorf("d=%s, want example.org", v.Domain)
+	}
+	for _, want := range []string{"c=relaxed/simple", "s=sel", "h=From:To:Subject:Date:From"} {
+		if !strings.Contains(strings.ReplaceAll(sig.HeaderValue, "\n", ""), want) {
+			t.Errorf("signature lacks %q: %s", want, sig.HeaderValue)
+		}
+	}
+	// A second From: added on the way breaks it: From is over-signed.
+	tampered := append([]field{{"From", " Mallory <m@evil.example>"}}, testHeaders...)
+	if v := verifyWith(t, f.record, delivered(sig, tampered, testBody)); v.Err == nil {
+		t.Error("a From: added above still verifies")
+	}
+	// A changed body breaks it.
+	if v := verifyWith(t, f.record, delivered(sig, testHeaders, testBody+"more\r\n")); v.Err == nil {
+		t.Error("a changed body still verifies")
+	}
+}
+
+// Two messages on one connection are signed each on their own.
+func TestSignerSignsEachMessageOfAConnection(t *testing.T) {
+	f := newSignFixture(t)
+	s := startSigner(t, f, appDomains)
+	for i, body := range []string{testBody, "Another body.\r\n"} {
+		sig := signed(t, s, "app1", testHeaders, body)
+		if v := verifyWith(t, f.record, delivered(sig, testHeaders, body)); v.Err != nil {
+			t.Fatalf("message %d: %v", i+1, v.Err)
+		}
+	}
+}
+
+// An empty body and a body without a final line end are signed as Postfix
+// delivers them.
+func TestSignerSignsOddBodies(t *testing.T) {
+	f := newSignFixture(t)
+	for _, body := range []string{"", "no final line end"} {
+		s := startSigner(t, f, appDomains)
+		sig := signed(t, s, "app1", testHeaders, body)
+		if v := verifyWith(t, f.record, delivered(sig, testHeaders, body)); v.Err != nil {
+			t.Fatalf("body %q: %v", body, v.Err)
+		}
+	}
+}
+
+// The panel's own socket signs with the server's name whatever the login.
+func TestSignerOnTheLocalSocketUsesItsDomain(t *testing.T) {
+	f := newSignFixture(t)
+	s := startSigner(t, f, func(string) string { return "example.org" })
+	sig := signed(t, s, "", testHeaders, testBody)
+	if v := verifyWith(t, f.record, delivered(sig, testHeaders, testBody)); v.Err != nil || v.Domain != "example.org" {
+		t.Fatalf("d=%s err=%v", v.Domain, v.Err)
+	}
+}
+
+// What cannot be signed is deferred, never passed on unsigned.
+func TestSignerDefersWhatItCannotSign(t *testing.T) {
+	cases := []struct {
+		name  string
+		login string
+		setup func(t *testing.T, f signFixture)
+	}{
+		{"a login with no domain", "stranger", nil},
+		{"no line for the domain", "app1", func(t *testing.T, f signFixture) {
+			if err := os.WriteFile(f.table, []byte("other.example other.example:sel:"+filepath.Join(f.keysDir, "other.example", "sel.private")+"\n"), 0o640); err != nil {
+				t.Fatal(err)
+			}
+		}},
+		{"a key file that is gone", "app1", func(t *testing.T, f signFixture) {
+			if err := os.Remove(filepath.Join(f.keysDir, "example.org", "sel.private")); err != nil {
+				t.Fatal(err)
+			}
+		}},
+		{"a key path outside the key directory", "app1", func(t *testing.T, f signFixture) {
+			outside := filepath.Join(f.dir, "sel.private")
+			if err := os.Rename(filepath.Join(f.keysDir, "example.org", "sel.private"), outside); err != nil {
+				t.Fatal(err)
+			}
+			if err := os.WriteFile(f.table, []byte("example.org example.org:sel:"+outside+"\n"), 0o640); err != nil {
+				t.Fatal(err)
+			}
+		}},
+		{"a key table that is not one", "app1", func(t *testing.T, f signFixture) {
+			if err := os.WriteFile(f.table, []byte("example.org\n"), 0o640); err != nil {
+				t.Fatal(err)
+			}
+		}},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			f := newSignFixture(t)
+			if c.setup != nil {
+				c.setup(t, f)
+			}
+			s := startSigner(t, f, appDomains)
+			mods, act := sendMessage(t, s, c.login, testHeaders, testBody)
+			if act.Code != milter.ActTempFail || len(mods) != 0 {
+				t.Fatalf("got %+v with %d modifications, want tempfail and none", act, len(mods))
+			}
+		})
+	}
+}
+
+// signLines writes the block Postfix will deliver and names what is signed.
+func TestSignLines(t *testing.T) {
+	keys, block := signLines(testHeaders)
+	if got := strings.Join(keys, ":"); got != "From:To:Subject:Date:From" {
+		t.Errorf("keys %s", got)
+	}
+	want := "From: Alice <alice@example.org>\r\nTo: bob@example.net\r\n" +
+		"Subject: a subject that is\r\n\tfolded over two lines\r\n" +
+		"Date: Thu, 15 Oct 2026 20:00:00 +0000\r\nMessage-ID: <1@example.org>\r\n" +
+		"X-Mailer:no space after the colon\r\n\r\n"
+	if string(block) != want {
+		t.Errorf("block\n%q\nwant\n%q", block, want)
+	}
+}