dkim: fix subdomain checking issue

crates/dkim/src/header.rs

@@ -1,4 +1,5 @@
 use crate::{parser, DKIMError, HeaderList};
+use dns_resolver::Name;
 use indexmap::map::IndexMap;
 use std::str::FromStr;
 use textwrap::core::Word;
@@ -192,8 +193,15 @@ impl DKIMHeader {
         // of the "i=" tag
         if let Some(user) = header.get_tag("i") {
             let signing_domain = header.get_required_tag("d");
-            // TODO: naive check, should switch to parsing the domains/email
-            if !user.ends_with(&signing_domain) {
+            let Some((_local, domain)) = user.split_once('@') else {
+                return Err(DKIMError::DomainMismatch);
+            };
+
+            let i_domain = Name::from_str_relaxed(domain).map_err(|_| DKIMError::DomainMismatch)?;
+            let d_domain =
+                Name::from_str_relaxed(signing_domain).map_err(|_| DKIMError::DomainMismatch)?;
+
+            if !d_domain.zone_of(&i_domain) {
                 return Err(DKIMError::DomainMismatch);
             }
         }

crates/dkim/src/lib.rs

@@ -406,6 +406,13 @@ b=dzdVyOfAKCdLXdJOc9G2q8LoXSlEniSbav+yuU4zGeeruD00lszZ
             DKIMHeader::parse(header).unwrap_err(),
             DKIMError::DomainMismatch
         );
+
+        let header = r#"v=1; a=rsa-sha256; d=example.net; s=brisbane.net; i=foo@fexample.net; h=headers; bh=hash; b=hash
+        "#;
+        assert_eq!(
+            DKIMHeader::parse(header).unwrap_err(),
+            DKIMError::DomainMismatch
+        );
     }
 
     #[test]

docs/changelog/main.md

@@ -104,3 +104,5 @@
  * [keysource](../reference/keysource.md) now supports callback/event based
    data loading, which is similar to inline `key_data`, but allows for more
    efficient cache keys that use less RAM.
+ * dkim verification would incorrectly treat `i=@fexample.net` as a valid
+   subdomain of `d=example.net`.