DKIM does not work: DKIM verify result: DKIM verification failed: signature verification failed

Symptoms

• The following mail settings are turned on: Allow signing outgoing mail and Verify incoming mail in Tools & Settings > Mail Server Settings on sending and receiving mail servers.
• Use DKIM spam protection system to sign outgoing email messages is enabled in Home > Domains > example.com > Mail Settings.
• /var/log/maillog on receiving server contains the following error:

  CONFIG_TEXT: DKIM verify result: DKIM verification failed: signature verification failed

Cause

Product bug PPPM-5149 is created. DKIM has two canonicalization modes - simple and relaxed. c=simple/simple mode is used by default. But some servers and mail clients can make changes in e-mail headers and body such as a number or white spaces, letters case in header, spaces in the end of body string. And DKIM signature gets invalid. 

More information can be found here.

Resolution

The bug was fixed in Plesk Onyx Update 6.
Install the latest Plesk updates.

Also, for Plesk Onyx 17.0 on Debian 8.6 the following workaround can be applied:

1. Connect to the server via SSH

2. Download the hotfix for Plesk Onyx 17.0.17:

   # cd /root
   # wget https://support.plesk.com/hc/en-us/article_attachments/115004356765/dk_sign

3. Backup the file /opt/psa/handlers/hooks/dk_sign:

   # cp /opt/psa/handlers/hooks/dk_sign /opt/psa/handlers/hooks/dk_sign.orig

4. Replace the original file with the downloaded one:

   # mv -f /root/dk_sign /opt/psa/handlers/hooks/