The check at the end of dkim_header() for match against DKIM_SIGNHEADER checks for colon in 'hdr', which is always true. Thus, the strncasecmp() there can match any header like:
D:
DK:
DKI:
Instead, the hdr length should be checked to make sure it is the same length as DKIM_SIGNHEADER..
Patch attached.
dkim_header.diff
Logged In: YES
user_id=1048957
Originator: NO
Patch applied for next release.
Logged In: YES
user_id=1048957
Originator: NO
v2.4.0 released.