Forwarding rule + AWS SES relay / "Duplicate header 'DKIM-Signature'"

freiser

Hi,

I'm running a grommunio appliance (latest supported version) with AWS SES as the relay host for outbound mail delivery. For one user (referred to below as user@my-domain.com), a forwarding rule has been configured via Grommunio Web (client-side inbox rule) that automatically forwards all incoming emails to an external address (user@external-provider.com).
When forwarding emails that already contain a DKIM-Signature from the original sending server, the following delivery error occurs:

Reporting-MTA: dns; mail.my-domain.com
X-Postfix-Queue-ID: 0621F6CE4CC
X-Postfix-Sender: rfc822; user@my-domain.com
Arrival-Date: Mon, 21 Sep 2026 20:41:19 +0200 (CEST)

Final-Recipient: rfc822; user@external-provider.com
Original-Recipient: rfc822;user@external-provider.com
Action: failed
Status: 5.0.0
Remote-MTA: dns; email-smtp.eu-central-1.amazonaws.com
Diagnostic-Code: smtp; 554 Transaction failed: Duplicate header 'DKIM-Signature'.

Suspected cause:

When the original message is forwarded, the appliance apparently adds a new DKIM-Signature for our own domain without removing the existing DKIM-Signature from the original sender. As a result, the forwarded message ends up containing two DKIM-Signature headers.
I have not configured DKIM signing myself, so I'm not sure whether this is enabled/active by default on the appliance, or where this behavior originates.
According to RFC 6376, multiple DKIM signatures are generally permitted, however AWS SES (email-smtp.eu-central-1.amazonaws.com) apparently rejects such messages strictly with a 554 error.

Environment:

grommunio appliance, latest supported version
Forwarding rule configured via Grommunio Web (inbox rule), not via Postfix/transport maps
AWS SES used as outbound relay host
No manual DKIM configuration done on my end

Questions for the community:

Is DKIM signing enabled by default on the appliance, and if so, where is this configured?
Is this behavior (re-signing forwarded messages without removing old DKIM headers) known or intended?
Is there a recommended/intended configuration to strip existing DKIM signatures before re-signing in the forwarding case?
Is it known whether AWS SES as a relay host generally has issues with multiple DKIM signatures, and is there already a solution/best practice for this within the appliance?

I would greatly appreciate any hints or experiences from other users with a similar setup (grommunio + AWS SES + Grommunio Web forwarding rules).

Br
freiser

freiser

Hello everyone,

Cause / Solution found:
An incoming email with an existing DKIM signature is forwarded via a rule. DKIM signing is not enabled locally on our Grommunio system. When using the Amazon AWS SES relay with Easy DKIM enabled, SES adds its own DKIM signature when sending the message. Since the original signature of the forwarded mail is not removed, this results in two DKIM-Signature headers in the outgoing mail. This causes the following error when sending via SES:

554 Transaction failed: Duplicate header 'DKIM-Signature'

Solution:
We remove the existing DKIM-Signature header of the incoming mail before it is forwarded outbound. This way, only the signature added by AWS SES (Easy DKIM) remains.

Create a PCRE map file /etc/postfix/ses_forward_rewrite:
/^DKIM-Signature:/ IGNORE
Add the following line to /etc/postfix/main.cf:
smtp_header_checks = pcre:/etc/postfix/ses_forward_rewrite

Important: You must use smtp_header_checks (outbound/client side), not smtpd_header_checks (inbound/server side), since the error occurs when relaying the message onward to SES.

Check the configuration and reload Postfix:

postfix check
systemctl reload postfix

After this change, forwarded emails are delivered without errors.