Re: _DKIMDOMAIN_ vs. _AUTHORDOMAIN_

[Benny Pedersen <me...@junc.eu>]

Matus UHLAR - fantomas skrev den 2022-10-07 10:59:

> just bumping this if anyone has idea how to process DKIMWL and spamhaus 
> DWL
> in more efficient matter.

there is no data in dwl.spamhaus.org but the rule for testing is still 
in current spamassassin as disabled rule

grep -r dwl ...

Re: _DKIMDOMAIN_ vs. _AUTHORDOMAIN_

[Matus UHLAR - fantomas <uh...@fantomas.sk>]

>On Fri, Oct 07, 2022 at 03:01:17PM +0200, Matus UHLAR - fantomas wrote:
>> the _DKIMDOMAIN_ can contain multiple domains if mail is signed using
>> multiple valid keys.

On 07.10.22 16:35, Henrik K wrote:
>Not a problem, as AskDNS doc says:
>
>"Tags which produce multiple values will result in multiple queries
>launched, each with an expanded template using one of the tag values.  An
>example is a DKIMDOMAIN tag which yields a list of signing domains, one for
>each valid signature in a signed message."

oh, I should better read docs then

>_DKIMDOMAIN_ contains verified domains.
>
>_AUTHORDOMAIN_ is simply the From: address without any verification.  It has
>nothing to do with DKIM.  So it would make no sense to use this.

as I undesstand it, it only makes sense to lookup domain in From: 
(_AUTHORDOMAIN_) and only when the mail is DKIM-signed with this domain.
That means, it only makes sende when DKIM_VALID_AU matches.

unless, of course, we want decrease score in case of e-mail has valid DKIM 
signature from any listed domain, no matter if it comes from that domain or 
not.
- but I don't think this is the case. 

-- 
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Christian Science Programming: "Let God Debug It!".

Re: _DKIMDOMAIN_ vs. _AUTHORDOMAIN_

[Henrik K <he...@hege.li>]

On Fri, Oct 07, 2022 at 03:01:17PM +0200, Matus UHLAR - fantomas wrote:
> 
> the _DKIMDOMAIN_ can contain multiple domains if mail is signed using
> multiple valid keys.

Not a problem, as AskDNS doc says:

"Tags which produce multiple values will result in multiple queries
launched, each with an expanded template using one of the tag values.  An
example is a DKIMDOMAIN tag which yields a list of signing domains, one for
each valid signature in a signed message."

_DKIMDOMAIN_ contains verified domains.

_AUTHORDOMAIN_ is simply the From: address without any verification.  It has
nothing to do with DKIM.  So it would make no sense to use this.

Re: _DKIMDOMAIN_ vs. _AUTHORDOMAIN_

[Matus UHLAR - fantomas <uh...@fantomas.sk>]

>Matus UHLAR - fantomas skrev den 2022-10-07 10:59:
>>just bumping this if anyone has idea how to process DKIMWL and 
>>spamhaus DWL
>>in more efficient matter.

On 07.10.22 14:35, Benny Pedersen wrote:
>there is no data in dwl.spamhaus.org but the rule for testing is still 
>in current spamassassin as disabled rule

I must to write it again because you have removed the important part:

the rule is apparently invalid.

the _DKIMDOMAIN_ can contain multiple domains if mail is signed using 
multiple valid keys.

the same applies for DKIMWL rules.

the _AUTHORDOMAIN_ should be used instead.


further:

these rules should be imho only used if DKIM_VALID_AU matches, because 
there's no point to check DWL/DKIMWL if the mail is not (correctly) 
DKIM-signed with sender domain, but with any other domain no matter if it's 
listed.

we could possibly spare DWL lookup.


... unless the poing of DWL and DKIMWL is to increate score for mail DKIM-signed 
with domain in particular list, even if the domain in From: does not match 
the one listed.


-- 
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Honk if you love peace and quiet.