DKIM l= tag
The optional DKIM tag stating how many bytes of the body the signature covers; RFC 6376 warns it lets content be appended unseen.
What it means
l= was meant to keep signatures valid when mailing lists append a footer: the signer declares the body length it hashed, and anything after that is ignored. The same property is the problem. Anyone who gets hold of a signed message can add content after the signed length, including a whole replacement message in HTML or MIME tricks, and the signature still verifies.
RFC 6376 tells signers to be extremely wary of it and says verifiers might wish to ignore signatures that use it.
Sign the full body. If a platform you use adds l= by default, turn it off.
Example
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=s1; l=1024; ...Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
All 432 terms in the glossaryThe wiki: blocklists and bounce codes