# ChangeLog for domain-auth
## 0.2.5
* Supporting crypton >= 1.1 and crypton-x509 >= 1.8.
* DKIM/DomainKeys: malformed signatures and public keys (unknown
algorithms or canonicalizations, duplicated tags, bad base64) no
longer throw exceptions; they are treated as permerror or fail.
* DKIM: signed header fields are selected bottom-up from the entire
header (RFC 6376 Section 5.4.2). `fieldsWith` now selects the last
instance first. This fixes an oversigning bypass by adding a field
above DKIM-Signature.
* SPF: "a", "mx", "include" and "redirect" are counted against `limit`.
More than 10 MX records or more than 2 void lookups are permerror
(RFC 7208 Section 4.6.4). Out-of-range CIDR lengths are rejected.