Oh, I should clarify - whoops - the emails I sent, when viewed in my sent folder in Thunderbird, look just fine and aren't reporting any problems at all, and it thinks everything is fine. I had a mac-using coworker confirm for me that my emails look fine to him in Mac Mail, though.

Ok, I just tried s/mime to another of my accounts. when I open it it looks good, but the message when synced to another installation of Thunderbird without the smime certificate installed, I get an error about the message having no digital signature. (even if it is in the send folder.)

But I digress. Do you have some fool in admin adding to your emails after they are signed. (part of the SMTP process usually) Things like the email being intended for the recipient only or other such unenforceable contractual obligations on the recipient. Or text like scanned by such and such anti virus that needs free advertising. This sounds unlikely, but it may only be mail leaving the organization that gets this treatment.

Or your recipient may have software that modifies the subject or body of the email

The signing process creates a checksum of the content of the email. So if your recipient has something in place to modify the received mail then there will be an error about it being altered, because it has.

(whoops, accidental multi-post - doesn't look like I can delete them, just edit them)

(whoops, accidental multi-post)

Hi Matt - I walked back through everything:

Created a VM, installed Thunderbird version 78, which had been working fine with Outlook + SMIME (from http://ftp.mozilla.org/pub/thunderbird/releases/78.9.1/win32/en-US/) added my office 365 work account to it sent test emails to my gmail address.

everything worked fine!

Updated VM's thunderbird from 78 -> 91 via regular in-application updater. Emails sent from TB 91... still worked fine? That blew my theory out of the water.

After a lot more trial and error and trying to make everything between my regular TB 91 install and the test TB 91 install on my VM, I found the issue: it's the the signature, but not the digital signature! it's the "signature text" block right on the very first page of the account settings.

!!!!

On my regular TB instance, with Office 365 (this is the only email account I have a digital certificate with so I can't test to see if this affects other accounts I sent from), this email signature (with the "Use HTML" checked in Account settings) has been working great for 7 years now:

Zach Heise < br /> Social Sciences Computing Cooperative < br /> <a href="https://www.sscc.wisc.edu/about-the-ssc/sscc-staff/">Work and Contact Information</a> < br />< br />

However, I find that now, with Thunderbird 91 on both the test VM and my regular account, having that <a href="link">link looks like this</a> results in the signature breaking.

This might be because Office 365 is doing some sort of email scanning on signature links (only for Thunderbird or IMAP perhaps; sending email with the exact same HTML signature works fine from outlook) and something about how TB 91+ is handling HTML <a> tags in signatures is causing something that is making the email be modified in transit.

If I change my email signature to: Zach Heise < br /> Social Sciences Computing Cooperative < br /> and send that in Thunderbird 91+ with HTML turned on, outlook likes it just fine. It's only when the <a> is added that breakage aoccurs.

It is clear, however, that something changed in Thunderbird between 78 and 91 pertaining to how email signatures work, probably with HTML in particular, because I confirmed a final time that I can still go back to TB 78, use that same HTML email signature, and Outlook reports email sent with that signature is not broken. So my Office 365 tenant administrators didn't change anything on their end. But whatever change that Thunderbird made... I wonder if it is possible to change it so that we can use HTML <a> tags again in our email signatures?

"View Source" in Outlook for my test message results in the following: <meta http-equiv="content-type" content="text/html; charset=UTF-8">

Okay, here's with the full email signature + HTML does this still work in tb78?

then, I update from TB78 -> 91 and do the exact same email, and view source in that message from outlook: <meta http-equiv="content-type" content="text/html; charset=UTF-8">

Okay, here's with the full email signature + HTML does this still work in tb91?

Looks identical I know! But Outlook says that this message has been modified in transit, and it doesn't say that about the message from TB78.

Okay this has been a long hour of testing. I hope perhaps something can be figured out, but I guess in the meantime, I have a workaround.

Argh, a lot of my HTML got broken by putting it in this form. Is there a guide to this support forum for how to post HTML code in a box that doesn't get parsed by the HTML renderer?

Seems like I spoke too soon - emails that I digitally signed that are replies, containing someone else's previous email, are still a problem, even with my email signature entirely turned off.

The one way I can force it to work with replies, I have just found, is by doing Options -> Delivery Format -> Plain Text Only. The digitally-signed emails resulting from this, when I view in my sent folder (or when the recipient gets my email in their inbox) are not showing as broken.

Found a bugzilla report for this, will be following this since it's where it's most likely to be fixed: https://bugzilla.mozilla.org/show_bug.cgi?id=1731529

Solved by release of Thunderbird 91.3

Update: TB 91.4.1 fixed our problem

Unfortunately we still have this problem. 91.3 did not work in our case. If I manually set Options → Delivery Format to Plain and Rich (HTML) Text and there is any part of HTML (it can be a content of the message or a company's signature in html) the S/MIME signature is displayed as incorrect. If I manually set Options → Delivery Format to Plain Text S/MIME signature is ok but company's signature and any messages written by a second person are converted to plain text which looks not so good.

This might be important: Even if delivery format is set to html or text and html but there is only pure text in the message, the signature is correct. Any use of html causes problem.

My tech-colleagues have found out that the real problem is on Outlook side but the reason is the change of encoding messages in TB 91 from Content-Transfer-Encoding: quoted-printable to Content-Transfer-Encoding: 8bit (not supported by different versions of Outlooks).

I wonder if it is possible to enable previous encoding on Thunderbird side.

The problem is still on thunderbird 91.7.0 With both HTML and Plain text

I confirm that the problem still persist on thunderbird 91.7

I also tried to configure a fresh new TB profile with a different s/mime certificate from another CA with no success.