dkim | DKIM signing for Go

nodemailer is a Node.js library and cannot be used in the client side. That's why you see the error Can't resolve 'fs'.

What you may do instead is to create an API route(which will be performed in the server side) and have the client app calls the API to perform the mailing task.

Whether mail ends up in spam is very difficult to control. Implementing SPF and DKIM can help, but still provide no guarantees. If it was easy to bypass spam filters, spammers would do it, and they would not be spam filters! There's an article in the PHPMailer wiki about avoiding spam filters that you may find helpful. The headers in a received message will often tell you why a message has been put in the spam folder, for example listing the spamassassin rules it matched.

You say it works "manually", but is that sending from the same place (e.g. on your local machine)? You can get the raw text of messages sent through each route and compare them to see what's different (other than obvious things like message IDs).

That MailGun article is outdated. Since then, RFC8314 has not only "undeprecated" port 465, it's now recommended as the default because it eliminates a possible attack vector in the pre-encryption stage that SMTP+STARTTLS uses on port 587. Unfortunately it also makes it harder to debug from PHP, and denies the chance to do opportunistic encryption when encryption is not requested explicitly, so it's not the default in PHPMailer (yet).

To set your mind at ease, your setup is fine! Nothing to worry about.

DKIM is, among other things a reputation tool. SendGrid is adding two signatures to your emails, one for your domain, which will help pass DMARC authentication. And one for their domain / service. This second one is optional from the DMARC perspective, but may improve Inbox delivery.

There are many services that operate in a similar fashion, adding an additional DKIM signature to outbound emails.

That is odd. The sending source IP is definitely in your SPF, and the DMARC record includes aspf=r, so the header from address in a child domain is valid and matches. I'd also note that your DMARC has p=quarantine, but gmail is acting like it's reject. This is gmail though, so you can't expect it to behave well.

I expect that the problem is that you don't have an SPF record set for server.cbs-canon.com, so make sure that exists and allows the same sources as cbs-canon.com. It looks like you're not doing DKIM signatures either, meaning that both SPF and DKIM are failing, resulting in a DMARC failure. Try adding that DNS record, or redirecting/including server. to your root domain.

Basically, your operating system defines the character / character sequence for the end of the line. Your particular application might or might not follow that.

If you want to limit the change to your initial regex, adding \r is (to me) the most straightforward approach. If you want to limit the number of characters in your regex, you could go for \s -- which would encompass blank, \n and \r - but \t as well, which is not allowed at this time.

Talking of potential simplification: Within the character class (between the square brackets), escaping round brackets/parentheses and the dot / full stop is usually not required - leaving you with
^Authentication-Results:[0-9a-zA-Z =().\n\r;-]*
But you need to verify in your particular environment.

Please comment, if and as this requires adjustment / further detail.

You state "This is not the correct directory, it should be /var/vmail/nostalgicmail.com/brad". Your (helpfully supplied) config contains,

It sounds like you want to run a mail transfer agent (MTA) that relays email to remote SMTP servers. An MTA will typically act as an SMTP server to receive messages, and then it will act as an SMTP client when it relays the messages to remote hosts.

MTAs generally operate in two different modes: (1) They will relay messages from authenticated users to remote hosts, and (2) they will receive messages from remote hosts to its users and store them somehow. The combination of those two modes - where the MTA will accept messages from remote hosts and relay them to different remote hosts - is called an open relay and is sure to attract spammers and place your server on spam blacklists.

aiosmtpd is not an MTA or an email relay out of the box - it is merely an SMTP server that will receive messages and do whatever with the messages you program it to do. By default it will do nothing - that is, it will receive the messages and throw them away. If you want to implement an email relay in aiosmtpd, then you need to implement the SMTP client portion of the MTA, e.g. by implementing an aiosmtpd handler that instantiates smtplib.SMTP to connect to remote hosts.

However, if all you want is an email relay, then you most likely don't need aiosmtpd at all - postfix is probably a better choice.

aiosmtpd can be a good choice if you need to implement mailing list software or perform some automation tasks based on incoming emails from e.g. cameras or scanners.

If you want to implement an email relay in aiosmtpd, then you need to ensure that both the software and your server are configured in a way that you don't relay unauthenticated messages from the outside internet.

See also: Python aiosmtpd - what is missing for an Mail-Transfer-Agent (MTA)?

you want to parse text/html parts

you should check for content type == 'text/html'

DKIM public keys are encoded in the binary DER format and shared as Base64 in the DNS. RSA public keys consist of a modulus and an exponent. The exponent is typically 65537, which is 01 00 01 in hexadecimal. DER prefixes this value with 02 for the integer type and 03 for the length of the exponent in bytes. The Base64 encoding of 02 03 01 00 01 is IDAQAB (at the right offset).

Before the modulus, which is unique for each RSA public key, there are nested length prefixes and an object identifier. This information is identical for RSA keys of the same length, which is why you find many DKIM public keys which also share the same prefix, such as MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA.