The last check of the port, and the plan's last line of stage 2c. Through
Postfix the sender check refuses most lines before OpenDKIM sees them, so
TestPortAgainstOpenDKIM (internal/milter) talks to OpenDKIM directly:
test/upstream/opendkim-probe.sh starts OpenDKIM from the SelfPost image in
a throwaway container, with keys and a refile SigningTable for three
names, and the test plays it each From: line through go-milter's client,
as a client OpenDKIM trusts (127.0.0.1, InternalHosts' default). For each
line the d= of the signature OpenDKIM adds must be the domain the port
predicts - its address, the domain cut to DKIM_MAXHOSTNAMELEN, the whole
cut to MAXADDRESS, matched against "^.*@<domain>$" case-insensitive as
dkimf_apply_signtable() matches - or neither signs.
Run on the test server, 2026-10-15 (OpenDKIM Filter v2.11.0 from the
image): 385 lines - both shared files and lines composed from display
names plain, quoted, escaped and encoded, comments nested and open,
groups, lists, brackets, source routes, domain literals and quoted local
parts, with the other sender's name and the server's in each place - 385
agree, 287 signed. The two lines padded so that, cut at 256 bytes, they
end in "@other.e2e.test" are signed by OpenDKIM with other.e2e.test's key:
the danger the sender check's 256-byte rule (3584adc) closes is real, and
the test now asserts it.
Measured while writing it: OpenDKIM answers a step it is done with by
accepting the message and then nothing more, and go-milter v0.4.1's client
needs read timeouts set in ClientOptions (the defaults apply only to its
default options) - the probe reads every step's action.
The differential test of the parser and this probe are now scripts in the
repository, test/upstream/mailparse-diff.sh and opendkim-probe.sh, both
run from it on the server: 200 019 lines agree with the C, 385 with the
signing. go vet and go test ./... pass on the server (24 packages). Stage
2c's plan lines are all ticked; roadmap 49/81.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
