15 June 2026
PhoenixDKIM 1.0.0 is the first stable release, closing the 1.0.0 beta series. Alongside the features built up over the betas, this release adds a round of pre-release security and robustness hardening — the testing process is now documented on the Security page.
With StrictHeaders enabled, a message that cannot be signed because it violates RFC 5322 (for example a duplicate From, a known spoofing vector) is now refused back to its sender — with the specific reason in the SMTP reply — per On-SignatureError (default reject). The verifying side is unchanged: such a message is accepted and the condition recorded in the Authentication-Results field. The two directions are dispositioned independently.
smfi_main() returns without joining libmilter's per-connection worker threads, so the previous teardown could free the configuration, signing key, and databases while a worker was still processing a message — an exit-time use-after-free. The daemon now drains in-flight connections before tearing down. Steady-state processing under load was never affected.
Coverage-guided libFuzzer targets for the DKIM-Signature and public-key parsers, on AddressSanitizer/UndefinedBehaviorSanitizer — no crashes, leaks, or undefined behaviour over ~126 million executions.
A DNS failure-mode classification test, an independent-implementation interop cross-check against dkimpy, and a ThreadSanitizer build option.
A leak in the resign + header-binding path and a benign test-tool leak fixed; the suite runs clean under AddressSanitizer/LeakSanitizer.
Full notes: 1.0.0 release notes; source and signatures on the Download page.