An S/MIME signature covers the exact MIME bytes. Changing a line ending, transfer encoding, boundary, or header after signing changes the digest. A message that verifies before SMTP can therefore fail after a relay normalizes malformed line endings.
Last updated: November 6, 2026.
openssl smime -verify -in delivered-message.eml -CAfile trusted-ca-chain.pem -out verified-content.txt
# Detect a bare carriage return that is not followed by line feed.
python -c "import re,sys; b=open(sys.argv[1],'rb').read(); print([m.start() for m in re.finditer(b'\r(?!\n)', b)][:20])" delivered-message.emlVerify the raw message exported by the receiving mailbox, not text copied from a mail client. Preserve the original file because displaying or forwarding a message can rewrite its MIME structure. Record a SHA-256 hash of each captured EML file before analysis.
Sign once and do not rewrite afterward
The Symfony Mailer S/MIME guide signs an Email with SMimeSigner and sends the returned signed message. Add recipients, body alternatives, attachments, and headers before signing. Do not normalize lines, append a footer, or rebuild the MIME message afterward.
RFC 8551 defines S/MIME message signing. MIME canonicalization matters because the recipient calculates a digest over the received signed entity. Standards-compliant CRLF line endings are especially important across SMTP relays.
Test the complete delivery path
A current Symfony Mime report describes CRLF being split at a stream chunk boundary, creating a bare carriage return in some signed messages. A tolerant local OpenSSL check may pass while a relay normalizes that byte and invalidates the recipient’s digest. Record the exact Symfony Mime, PHP, and OpenSSL versions when reproducing it.
Send several messages with different body and attachment sizes through the same provider path used in production. Export each delivered message as raw EML and verify it independently. If the issue reproduces, update to a Symfony release containing the verified fix; otherwise pin a tested release or signing path. Do not repair the signed MIME bytes after signing.
Monitor signature failures separately from delivery failures. Continue with S/MIME signing with PHPMailer, multipart email construction, and email delivery troubleshooting.
