You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Thore Boedecker <me...@foxxx0.de> on 2017/05/06 13:49:08 UTC
Strict/Relaxed DKIM alignment possible with SA?
Hello folks,
over the last couple of months I have received some nasty spam,
delivered by the Yahoo mail servers.
After looking at the headers it became clear what the issue was:
It seems that Yahoo (at least yahoo.co.jp) is allowing emails from
@gmail.com senders to be sent through their servers.
The funny thing is, that there is a @gmail.com address in both the
'From:' and 'Return-Path:' headers, but a @yahoo.com address in the
'Reply-To:' and 'Sender:' headers.
Somehow Yahoo sees no problem in that and is happy to DKIM sign those
emails with a correct *Yahoo* signature.
Over on my side, the receiving end of these emails, there is my
spamassassin. SA discovers the DKIM signature and is able to validate
this signature against the Yahoo server which is totally undesirable
in my opinion.
Maybe strict DKIM alignment is not always the best choice, because
sometimes the emails are signed by different servers without sharing
one signing key for the entire domain.
So is there any way to make SA perform at least a relaxed DKIM
alignment check on the headers so that the DKIM signature domain has
to belong to the 'From:' address?
Any hints or suggestions are much appreciated.
Cheers,
Thore
--
Re: Strict/Relaxed DKIM alignment possible with SA?
Posted by Alex <my...@gmail.com>.
Hi,
On Sat, May 6, 2017 at 10:10 AM, David Jones <dj...@ena.com> wrote:
> From: Thore Boedecker <me...@foxxx0.de>
>
>>Hello folks,
>
>>over the last couple of months I have received some nasty spam,
>>delivered by the Yahoo mail servers.
>
>>After looking at the headers it became clear what the issue was:
>
> Please post the email in pastebin.com or something so we can
> help.
>
>>It seems that Yahoo (at least yahoo.co.jp) is allowing emails from
>>@gmail.com senders to be sent through their servers.
>>The funny thing is, that there is a @gmail.com address in both the
>>'From:' and 'Return-Path:' headers, but a @yahoo.com address in the
>>'Reply-To:' and 'Sender:' headers.
>>Somehow Yahoo sees no problem in that and is happy to DKIM sign those
>>emails with a correct *Yahoo* signature.
>
>>Over on my side, the receiving end of these emails, there is my
>>spamassassin. SA discovers the DKIM signature and is able to validate
>>this signature against the Yahoo server which is totally undesirable
>>in my opinion.
>
> DKIM is only meant to authenticate that the emails did come from
> a Yahoo server. It has nothing to do with authorization which is what
> you are looking for. SPF handles authorization so these emails should
> have a SPF_FAIL rule hit that we can confirm once we see it in
> pastebin.com.
>
>>Maybe strict DKIM alignment is not always the best choice, because
>>sometimes the emails are signed by different servers without sharing
>>one signing key for the entire domain.
>
>>So is there any way to make SA perform at least a relaxed DKIM
>>alignment check on the headers so that the DKIM signature domain has
>>to belong to the 'From:' address?
>
> This is done by DMARC. Currently you have to implement something
> like OpenDMARC in your MTA and then add custom rules that use the
> headers added specifically by your MTA (yourserverhere).
>
> header DMARC_PASS Authentication-Results =~ /yourserverhere; dmarc=pass/
> describe DMARC_PASS DMARC check passed
> score DMARC_PASS -0.01
>
> header DMARC_FAIL Authentication-Results =~ /yourserverhere; dmarc=fail/
> describe DMARC_FAIL DMARC check failed
> score DMARC_FAIL 0.01
>
> header DMARC_NONE Authentication-Results =~ /yourserverhere; dmarc=none/
> describe DMARC_NONE DMARC check neutral
> score DMARC_NONE 0.01
RW posted some rules around this time last year:
https://www.mail-archive.com/users@spamassassin.apache.org/msg95643.html
How is this different/better? We have openDMARC running on one of our
systems, but that's for your own mail. How does it work with SA?
Re: Strict/Relaxed DKIM alignment possible with SA?
Posted by Thore Boedecker <me...@foxxx0.de>.
Thanks David for the first hints in the right direction and yes you
are right, I'm looking for some sort of DMARC integration into SA.
I have uploaded the mail here:
https://paste.foxxx0.de/wZjcT/
Thore
On 06.05.17 - 14:10, David Jones wrote:
> From: Thore Boedecker <me...@foxxx0.de>
>
> >Hello folks,
>
> >over the last couple of months I have received some nasty spam,
> >delivered by the Yahoo mail servers.
>
> >After looking at the headers it became clear what the issue was:
>
> Please post the email in pastebin.com or something so we can
> help.
>
> >It seems that Yahoo (at least yahoo.co.jp) is allowing emails from
> >@gmail.com senders to be sent through their servers.
> >The funny thing is, that there is a @gmail.com address in both the
> >'From:' and 'Return-Path:' headers, but a @yahoo.com address in the
> >'Reply-To:' and 'Sender:' headers.
> >Somehow Yahoo sees no problem in that and is happy to DKIM sign those
> >emails with a correct *Yahoo* signature.
>
> >Over on my side, the receiving end of these emails, there is my
> >spamassassin. SA discovers the DKIM signature and is able to validate
> >this signature against the Yahoo server which is totally undesirable
> >in my opinion.
>
> DKIM is only meant to authenticate that the emails did come from
> a Yahoo server. It has nothing to do with authorization which is what
> you are looking for. SPF handles authorization so these emails should
> have a SPF_FAIL rule hit that we can confirm once we see it in
> pastebin.com.
>
> >Maybe strict DKIM alignment is not always the best choice, because
> >sometimes the emails are signed by different servers without sharing
> >one signing key for the entire domain.
>
> >So is there any way to make SA perform at least a relaxed DKIM
> >alignment check on the headers so that the DKIM signature domain has
> >to belong to the 'From:' address?
>
> This is done by DMARC. Currently you have to implement something
> like OpenDMARC in your MTA and then add custom rules that use the
> headers added specifically by your MTA (yourserverhere).
>
> header DMARC_PASS Authentication-Results =~ /yourserverhere; dmarc=pass/
> describe DMARC_PASS DMARC check passed
> score DMARC_PASS -0.01
>
> header DMARC_FAIL Authentication-Results =~ /yourserverhere; dmarc=fail/
> describe DMARC_FAIL DMARC check failed
> score DMARC_FAIL 0.01
>
> header DMARC_NONE Authentication-Results =~ /yourserverhere; dmarc=none/
> describe DMARC_NONE DMARC check neutral
> score DMARC_NONE 0.01
>
> Dave
--
Re: Strict/Relaxed DKIM alignment possible with SA?
Posted by David Jones <dj...@ena.com>.
From: Thore Boedecker <me...@foxxx0.de>
>Hello folks,
>over the last couple of months I have received some nasty spam,
>delivered by the Yahoo mail servers.
>After looking at the headers it became clear what the issue was:
Please post the email in pastebin.com or something so we can
help.
>It seems that Yahoo (at least yahoo.co.jp) is allowing emails from
>@gmail.com senders to be sent through their servers.
>The funny thing is, that there is a @gmail.com address in both the
>'From:' and 'Return-Path:' headers, but a @yahoo.com address in the
>'Reply-To:' and 'Sender:' headers.
>Somehow Yahoo sees no problem in that and is happy to DKIM sign those
>emails with a correct *Yahoo* signature.
>Over on my side, the receiving end of these emails, there is my
>spamassassin. SA discovers the DKIM signature and is able to validate
>this signature against the Yahoo server which is totally undesirable
>in my opinion.
DKIM is only meant to authenticate that the emails did come from
a Yahoo server. It has nothing to do with authorization which is what
you are looking for. SPF handles authorization so these emails should
have a SPF_FAIL rule hit that we can confirm once we see it in
pastebin.com.
>Maybe strict DKIM alignment is not always the best choice, because
>sometimes the emails are signed by different servers without sharing
>one signing key for the entire domain.
>So is there any way to make SA perform at least a relaxed DKIM
>alignment check on the headers so that the DKIM signature domain has
>to belong to the 'From:' address?
This is done by DMARC. Currently you have to implement something
like OpenDMARC in your MTA and then add custom rules that use the
headers added specifically by your MTA (yourserverhere).
header DMARC_PASS Authentication-Results =~ /yourserverhere; dmarc=pass/
describe DMARC_PASS DMARC check passed
score DMARC_PASS -0.01
header DMARC_FAIL Authentication-Results =~ /yourserverhere; dmarc=fail/
describe DMARC_FAIL DMARC check failed
score DMARC_FAIL 0.01
header DMARC_NONE Authentication-Results =~ /yourserverhere; dmarc=none/
describe DMARC_NONE DMARC check neutral
score DMARC_NONE 0.01
Dave
Re: Strict/Relaxed DKIM alignment possible with SA?
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
>>On Sat, 6 May 2017 15:49:08 +0200
>>Thore Boedecker wrote:
>>> Over on my side, the receiving end of these emails, there is my
>>> spamassassin. SA discovers the DKIM signature and is able to validate
>>> this signature against the Yahoo server which is totally undesirable
>>> in my opinion.
>From: RW <rw...@googlemail.com>
>>SPF requires the mail to be sent out through designated hosts. A DKIM
>>pass for the correct domain means that the email passed through a host
>>with access to the signing key. DKIM provides better authorization than
>>SPF.
On 06.05.17 15:47, David Jones wrote:
>RW is correct. This email did not go through a Google mail server. Looks
>like the sender is using a mail client to send through Yahoo with the
>intention to get someone to reply back to a gmail.com address.
>
>Does anyone think it would be beneficial to extend the FreeMail plugin
>to detect these headers having different sender and reply-to FREEMAIL
>domains?
what does Sender: header give us in addition to envelope from?
this mail already hit FREEMAIL_REPLYTO
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
We are but packets in the Internet of life (userfriendly.org)
Re: Strict/Relaxed DKIM alignment possible with SA?
Posted by David Jones <dj...@ena.com>.
From: RW <rw...@googlemail.com>
>On Sat, 6 May 2017 15:49:08 +0200
>Thore Boedecker wrote:
>> Over on my side, the receiving end of these emails, there is my
>> spamassassin. SA discovers the DKIM signature and is able to validate
>> this signature against the Yahoo server which is totally undesirable
>> in my opinion.
>SPF requires the mail to be sent out through designated hosts. A DKIM
>pass for the correct domain means that the email passed through a host
>with access to the signing key. DKIM provides better authorization than
>SPF.
RW is correct. This email did not go through a Google mail server. Looks
like the sender is using a mail client to send through Yahoo with the
intention to get someone to reply back to a gmail.com address.
Does anyone think it would be beneficial to extend the FreeMail plugin
to detect these headers having different sender and reply-to FREEMAIL
domains?
You need to properly train your Bayes since this email hit BAYES_00. This
email was BCC'd which is another clue of spam in conjunction with the
FREEMAIL hits.
I bump up these FREEMAIL scores based on the masscheck results I saw
in the past:
score FREEMAIL_FROM 1.2
score FREEMAIL_REPLYTO 4.2
score FREEMAIL_REPLYTO_END_DIGIT 1.2
Disclaimer: Adjust these scores to your liking as I have an SA block at 6.0.
Dave
Re: Strict/Relaxed DKIM alignment possible with SA?
Posted by RW <rw...@googlemail.com>.
On Sat, 6 May 2017 15:49:08 +0200
Thore Boedecker wrote:
> Over on my side, the receiving end of these emails, there is my
> spamassassin. SA discovers the DKIM signature and is able to validate
> this signature against the Yahoo server which is totally undesirable
> in my opinion.
It doesn't score anything at all:
DKIM_SIGNED=0.1,DKIM_VALID=-0.1
and DKIM_VALID doesn't mean much anyway, any spammer can make that hit
if they can add their own header to the spam. It didn't hit
DKIM_VALID_AU.
On Sat, 6 May 2017 14:10:12 +0000
David Jones wrote:
> DKIM is only meant to authenticate that the emails did come from
> a Yahoo server. It has nothing to do with authorization which is what
> you are looking for. SPF handles authorization so these emails should
> have a SPF_FAIL rule hit that we can confirm once we see it in
> pastebin.com.
SPF requires the mail to be sent out through designated hosts. A DKIM
pass for the correct domain means that the email passed through a host
with access to the signing key. DKIM provides better authorization than
SPF.
Re: Strict/Relaxed DKIM alignment possible with SA?
Posted by Dominic Benson <do...@lenny.cus.org>.
> On 6 May 2017, at 14:49, Thore Boedecker <me...@foxxx0.de> wrote:
>
> Hello folks,
>
> over the last couple of months I have received some nasty spam,
> delivered by the Yahoo mail servers.
>
> After looking at the headers it became clear what the issue was:
>
> It seems that Yahoo (at least yahoo.co.jp) is allowing emails from
> @gmail.com senders to be sent through their servers.
> The funny thing is, that there is a @gmail.com address in both the
> 'From:' and 'Return-Path:' headers, but a @yahoo.com address in the
> 'Reply-To:' and 'Sender:' headers.
> Somehow Yahoo sees no problem in that and is happy to DKIM sign those
> emails with a correct *Yahoo* signature.
This is correct - Sender is a perfectly acceptable address header for DKIM and is consistent with the semantics of the user taking responsibility for the sending of the message.
Re: Strict/Relaxed DKIM alignment possible with SA?
Posted by David Jones <dj...@ena.com>.
From: Alex <my...@gmail.com>
>I'm just adding 1.5 points when DMARC tests fail and the policy is to
>reject. Is it safe to block them completely?
I am rejecting with OpenDMARC when the sender's DMARC record
has p=reject. This is what they asked for so I am doing it.
I have run into on case where a sender who's primary business is
to send emails setup DMARC with p=reject then used dmarcian.com
to help them with their implementation. They were not DKIM signing
and their SPF record was wrong. They blamed me for blocking their
email saying they didn't have any other reports of this happening
for any other customer. My response was to show them their own
DNS setting said to reject the email so my filters were doing exactly
that.
This sender should be getting some fancy reports and a dashboard
or something from dmarcian.com showing all of the failures but I
guess they are ignoring the reports.
>And why aren't DMARC tests part of the stock SA yet?
Someone needs to write a DMARC plugin for SA.
http://search.cpan.org/dist/Mail-DMARC/
Re: Strict/Relaxed DKIM alignment possible with SA?
Posted by Alex <my...@gmail.com>.
Hi,
>>>So is there any way to make SA perform at least a relaxed DKIM
>>>alignment check on the headers so that the DKIM signature domain has
>>>to belong to the 'From:' address?
>
>>every domain using yahoo mail servers would have to delegate DKIM to
>>yahoo and yahoo would need to sign under all those domains.
>>the same applies about any domain that does DKIM signing (e.g. gmail)
>
> Interestingly, _dmarc.yahoo.com TXT record has "p=reject" which would
> have caused a DMARC fail with a bounce. Looks like this spammer noticed
> that yahoo.co.jp does not have a DMARC record which allowed them to
> send this spam even to recipients with DMARC checks enabled and honoring
> "p=reject" like my mails filters do.
I'm just adding 1.5 points when DMARC tests fail and the policy is to
reject. Is it safe to block them completely?
And why aren't DMARC tests part of the stock SA yet?
>>that is in fact change in requirements on DKIM itself...
>
> I bet as we see DMARC gain traction like SPF has this will force these
> major mail hosting providers like Yahoo to shape up. Right now they are
> so big that we can't make them act responsibly. Yahoo should start rejecting
> email that is sent through them like this to prevent spammers abusing them.
>
> Google is slowly turning up the heat with DMARC which forces the Internet
> to implement it. I know this is a pain but I went through this pain a few years
> ago and now I am glad to see Google using their influence for good. In a few
> more years all of our spam filtering will be better because of this.
What does this mean for forwarded mail? I see there's already an
exception for mailing list mail in the SA rules. We have a mail system
with a few hundred users, virtually all of which forward their mail
through to gmail or another freemail account. It has an entry in the
top-level SPF record, but it rejects lots of mail from external
senders due to the originating sender's SPF policy.
Re: Strict/Relaxed DKIM alignment possible with SA?
Posted by RW <rw...@googlemail.com>.
On Sun, 7 May 2017 13:08:03 +0200
Matus UHLAR - fantomas wrote:
> On 07.05.17 12:46, Thore Boedecker wrote:
> >I have played around with it and SA is not performing actual SPF
> >queries/validations due to the use of spampd on localhost as a
> >proxy.
SA needs a trusted internal received header to be present at the time
of the scan. If it's missing you will break a lot more than SPF.
> that's why I recommended trying policyd-spf on valhalla.nano-srv.net
> - it could be able to push Received-SPF: header SA could use after...
>
But be aware that a Received-SPF header can only be used if SA finds it
above a trusted received header.
Re: Strict/Relaxed DKIM alignment possible with SA?
Posted by Robert Schetterer <rs...@sys4.de>.
Am 07.05.2017 um 13:08 schrieb Matus UHLAR - fantomas:
>>> > > On 07.05.17 00:46, Thore Boedecker wrote:
>>> > > > Thanks for all the great advice so far.
>>> > > >
>>> > > > Currently I'm playing around with opendkim->opendmarc->amavisd
>>> on my
>>> > > > testserver.
>>> > > >
>>> > > > My current postfix setup is using spampd as proxy and thus any
>>> > > > opendkim/opendmarc milters won't work in cojunction.
>>>
>>> > > > I've been planning to switch to amavis and use it as a milter for
>>> > > > quite some time now so maybe I should get on with it.
>>> [...]
>>> > > > Compiling opendmarc against libspf2 makes the opendmarc
>>> internal SPF
>>> > > > checker functional and now the SA SPF checks (triggered by
>>> amavis) are
>>> > > > firing as well.
>>>
>>> > On 07.05.17 - 11:46, Matus UHLAR - fantomas wrote:
>>> > > I would like to note that SPF can be used without openDMARC, and
>>> imho should
>>> > > work in SA itself.
>>> > >
>>> > > Did you (try to) make SPF working on valhalla.nano-srv.net?
>>>
>>> On 07.05.17 12:05, Thore Boedecker wrote:
>>> > It seems that I simply forgot the load the SPF module in my
>>> > spamassassin config.
>>> >
>>> > A few test mails from different servers are now hitting at least
>>> > the SPF_HELO_PASS rule but nothing else so far.
>
>> On 07.05.17 - 12:27, Matus UHLAR - fantomas wrote:
>>> try running spamassassin -D on a mail, if you get something like:
>>>
>>> May 6 22:38:47.009 [30327] dbg: spf: relayed through one or more
>>> trusted
>>> relays, cannot use header-based Envelope-From, skipping
>>>
>>> it may be caused by postfix forwarding mail via localhost
>>> - it's better to know if spampd (or later amavisd) can work around that.
>>>
>>> SPF_PASS, SPF_NEUTRAL, SPF_NONE, SPF_SOFTFAIL and SPF_FAIL will indicate
>>> that SPF works as expected.
>
> On 07.05.17 12:46, Thore Boedecker wrote:
>> I have played around with it and SA is not performing actual SPF
>> queries/validations due to the use of spampd on localhost as a proxy.
>
> that's why I recommended trying policyd-spf on valhalla.nano-srv.net
> - it could be able to push Received-SPF: header SA could use after...
>
>> The only way around this, that I know of, would be to switch to amavis
>> as it can be used as a milter.
>> Or is there a way to make SA work as a milter in postfix?
>
> spamass-milter should be supported.
works perfect since years
> I run amavisd-milter on one machine.
>
Best Regards
MfG Robert Schetterer
--
[*] sys4 AG
http://sys4.de, +49 (89) 30 90 46 64
Schleißheimer Straße 26/MG, 80333 München
Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263
Vorstand: Patrick Ben Koetter, Marc Schiffbauer
Aufsichtsratsvorsitzender: Florian Kirstein
Re: Strict/Relaxed DKIM alignment possible with SA?
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
>> > > On 07.05.17 00:46, Thore Boedecker wrote:
>> > > > Thanks for all the great advice so far.
>> > > >
>> > > > Currently I'm playing around with opendkim->opendmarc->amavisd on my
>> > > > testserver.
>> > > >
>> > > > My current postfix setup is using spampd as proxy and thus any
>> > > > opendkim/opendmarc milters won't work in cojunction.
>>
>> > > > I've been planning to switch to amavis and use it as a milter for
>> > > > quite some time now so maybe I should get on with it.
>> [...]
>> > > > Compiling opendmarc against libspf2 makes the opendmarc internal SPF
>> > > > checker functional and now the SA SPF checks (triggered by amavis) are
>> > > > firing as well.
>>
>> > On 07.05.17 - 11:46, Matus UHLAR - fantomas wrote:
>> > > I would like to note that SPF can be used without openDMARC, and imho should
>> > > work in SA itself.
>> > >
>> > > Did you (try to) make SPF working on valhalla.nano-srv.net?
>>
>> On 07.05.17 12:05, Thore Boedecker wrote:
>> > It seems that I simply forgot the load the SPF module in my
>> > spamassassin config.
>> >
>> > A few test mails from different servers are now hitting at least
>> > the SPF_HELO_PASS rule but nothing else so far.
>On 07.05.17 - 12:27, Matus UHLAR - fantomas wrote:
>> try running spamassassin -D on a mail, if you get something like:
>>
>> May 6 22:38:47.009 [30327] dbg: spf: relayed through one or more trusted
>> relays, cannot use header-based Envelope-From, skipping
>>
>> it may be caused by postfix forwarding mail via localhost
>> - it's better to know if spampd (or later amavisd) can work around that.
>>
>> SPF_PASS, SPF_NEUTRAL, SPF_NONE, SPF_SOFTFAIL and SPF_FAIL will indicate
>> that SPF works as expected.
On 07.05.17 12:46, Thore Boedecker wrote:
>I have played around with it and SA is not performing actual SPF
>queries/validations due to the use of spampd on localhost as a proxy.
that's why I recommended trying policyd-spf on valhalla.nano-srv.net
- it could be able to push Received-SPF: header SA could use after...
>The only way around this, that I know of, would be to switch to amavis
>as it can be used as a milter.
>Or is there a way to make SA work as a milter in postfix?
spamass-milter should be supported.
I run amavisd-milter on one machine.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
"Where do you want to go to die?" [Microsoft]
Re: Strict/Relaxed DKIM alignment possible with SA?
Posted by Thore Boedecker <me...@foxxx0.de>.
On 07.05.17 - 12:27, Matus UHLAR - fantomas wrote:
> > > On 07.05.17 00:46, Thore Boedecker wrote:
> > > > Thanks for all the great advice so far.
> > > >
> > > > Currently I'm playing around with opendkim->opendmarc->amavisd on my
> > > > testserver.
> > > >
> > > > My current postfix setup is using spampd as proxy and thus any
> > > > opendkim/opendmarc milters won't work in cojunction.
>
> > > > I've been planning to switch to amavis and use it as a milter for
> > > > quite some time now so maybe I should get on with it.
> [...]
> > > > Compiling opendmarc against libspf2 makes the opendmarc internal SPF
> > > > checker functional and now the SA SPF checks (triggered by amavis) are
> > > > firing as well.
>
> > On 07.05.17 - 11:46, Matus UHLAR - fantomas wrote:
> > > I would like to note that SPF can be used without openDMARC, and imho should
> > > work in SA itself.
> > >
> > > Did you (try to) make SPF working on valhalla.nano-srv.net?
>
> On 07.05.17 12:05, Thore Boedecker wrote:
> > It seems that I simply forgot the load the SPF module in my
> > spamassassin config.
> >
> > A few test mails from different servers are now hitting at least
> > the SPF_HELO_PASS rule but nothing else so far.
>
> try running spamassassin -D on a mail, if you get something like:
>
> May 6 22:38:47.009 [30327] dbg: spf: relayed through one or more trusted
> relays, cannot use header-based Envelope-From, skipping
>
> it may be caused by postfix forwarding mail via localhost
> - it's better to know if spampd (or later amavisd) can work around that.
>
> SPF_PASS, SPF_NEUTRAL, SPF_NONE, SPF_SOFTFAIL and SPF_FAIL will indicate
> that SPF works as expected.
I have played around with it and SA is not performing actual SPF
queries/validations due to the use of spampd on localhost as a proxy.
The only way around this, that I know of, would be to switch to amavis
as it can be used as a milter.
Or is there a way to make SA work as a milter in postfix?
>
> --
> Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
> Warning: I wish NOT to receive e-mail advertising to this address.
> Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
> REALITY.SYS corrupted. Press any key to reboot Universe.
--
Re: Strict/Relaxed DKIM alignment possible with SA?
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
>> On 07.05.17 00:46, Thore Boedecker wrote:
>> > Thanks for all the great advice so far.
>> >
>> > Currently I'm playing around with opendkim->opendmarc->amavisd on my
>> > testserver.
>> >
>> > My current postfix setup is using spampd as proxy and thus any
>> > opendkim/opendmarc milters won't work in cojunction.
>> > I've been planning to switch to amavis and use it as a milter for
>> > quite some time now so maybe I should get on with it.
[...]
>> > Compiling opendmarc against libspf2 makes the opendmarc internal SPF
>> > checker functional and now the SA SPF checks (triggered by amavis) are
>> > firing as well.
>On 07.05.17 - 11:46, Matus UHLAR - fantomas wrote:
>> I would like to note that SPF can be used without openDMARC, and imho should
>> work in SA itself.
>>
>> Did you (try to) make SPF working on valhalla.nano-srv.net?
On 07.05.17 12:05, Thore Boedecker wrote:
>It seems that I simply forgot the load the SPF module in my
>spamassassin config.
>
>A few test mails from different servers are now hitting at least
>the SPF_HELO_PASS rule but nothing else so far.
try running spamassassin -D on a mail, if you get something like:
May 6 22:38:47.009 [30327] dbg: spf: relayed through one or more trusted
relays, cannot use header-based Envelope-From, skipping
it may be caused by postfix forwarding mail via localhost
- it's better to know if spampd (or later amavisd) can work around that.
SPF_PASS, SPF_NEUTRAL, SPF_NONE, SPF_SOFTFAIL and SPF_FAIL will indicate
that SPF works as expected.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
REALITY.SYS corrupted. Press any key to reboot Universe.
Re: Strict/Relaxed DKIM alignment possible with SA?
Posted by Thore Boedecker <me...@foxxx0.de>.
On 07.05.17 - 11:46, Matus UHLAR - fantomas wrote:
> On 07.05.17 00:46, Thore Boedecker wrote:
> > Thanks for all the great advice so far.
> >
> > Currently I'm playing around with opendkim->opendmarc->amavisd on my
> > testserver.
> >
> > My current postfix setup is using spampd as proxy and thus any
> > opendkim/opendmarc milters won't work in cojunction.
> >
> > I've been planning to switch to amavis and use it as a milter for
> > quite some time now so maybe I should get on with it.
> >
> > So far it's working quite nice, took some time to get all services
> > working together but for now it's running without errors.
> >
> > Compiling opendmarc against libspf2 makes the opendmarc internal SPF
> > checker functional and now the SA SPF checks (triggered by amavis) are
> > firing as well.
>
> I would like to note that SPF can be used without openDMARC, and imho should
> work in SA itself.
>
> Did you (try to) make SPF working on valhalla.nano-srv.net?
It seems that I simply forgot the load the SPF module in my
spamassassin config.
A few test mails from different servers are now hitting at least
the SPF_HELO_PASS rule but nothing else so far.
>
>
> > On 06.05.17 - 22:54, Matus UHLAR - fantomas wrote:
> > > Also, the mail SHOULD hit SPF_* rule, if the SPF plugin is loaded, but there's none.
> > >
> > > maybe because:
> > >
> > > May 6 22:19:09.740 [30047] dbg: spf: relayed through one or more trusted relays, cannot use header-based Envelope-From, skipping
> > >
> > > ... caused by Received: line containing localhost. the OP should set up spf
> > > policyd on valhalla.nano-srv.net...
>
>
> > > For now the main problem at receiver's side seems to be missing SPF results.
>
> --
> Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
> Warning: I wish NOT to receive e-mail advertising to this address.
> Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
> Boost your system's speed by 500% - DEL C:\WINDOWS\*.*
--
Re: Strict/Relaxed DKIM alignment possible with SA?
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 07.05.17 00:46, Thore Boedecker wrote:
>Thanks for all the great advice so far.
>
>Currently I'm playing around with opendkim->opendmarc->amavisd on my
>testserver.
>
>My current postfix setup is using spampd as proxy and thus any
>opendkim/opendmarc milters won't work in cojunction.
>
>I've been planning to switch to amavis and use it as a milter for
>quite some time now so maybe I should get on with it.
>
>So far it's working quite nice, took some time to get all services
>working together but for now it's running without errors.
>
>Compiling opendmarc against libspf2 makes the opendmarc internal SPF
>checker functional and now the SA SPF checks (triggered by amavis) are
>firing as well.
I would like to note that SPF can be used without openDMARC, and imho should
work in SA itself.
Did you (try to) make SPF working on valhalla.nano-srv.net?
>On 06.05.17 - 22:54, Matus UHLAR - fantomas wrote:
>> Also, the mail SHOULD hit SPF_* rule, if the SPF plugin is loaded, but there's none.
>>
>> maybe because:
>>
>> May 6 22:19:09.740 [30047] dbg: spf: relayed through one or more trusted relays, cannot use header-based Envelope-From, skipping
>>
>> ... caused by Received: line containing localhost. the OP should set up spf
>> policyd on valhalla.nano-srv.net...
>> For now the main problem at receiver's side seems to be missing SPF results.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Boost your system's speed by 500% - DEL C:\WINDOWS\*.*
Re: Strict/Relaxed DKIM alignment possible with SA?
Posted by Thore Boedecker <me...@foxxx0.de>.
Thanks for all the great advice so far.
Currently I'm playing around with opendkim->opendmarc->amavisd on my
testserver.
My current postfix setup is using spampd as proxy and thus any
opendkim/opendmarc milters won't work in cojunction.
I've been planning to switch to amavis and use it as a milter for
quite some time now so maybe I should get on with it.
So far it's working quite nice, took some time to get all services
working together but for now it's running without errors.
Compiling opendmarc against libspf2 makes the opendmarc internal SPF
checker functional and now the SA SPF checks (triggered by amavis) are
firing as well.
Cheers o/
On 06.05.17 - 22:54, Matus UHLAR - fantomas wrote:
> > > On 06.05.17 15:49, Thore Boedecker wrote:
> > > > After looking at the headers it became clear what the issue was:
> > > >
> > > > It seems that Yahoo (at least yahoo.co.jp) is allowing emails from
> > > > @gmail.com senders to be sent through their servers.
>
> > From: Matus UHLAR - fantomas <uh...@fantomas.sk>
> > > @gmail.com From: and envelope from. Sender: was yahoo...
>
> On 06.05.17 17:55, David Jones wrote:
> > The headers imply that this was sent from the Yahoo webmail
> > interface which must allow users to setup an "identity" like
> > Thunderbird does that allows custom From: and Return-Path:
> > headers. They shouldn't allow this in their webmail interface.
>
> They should not, but this has nothing to do with the DKIM itself.
>
>
> > BTW, their webmail interface should also add an X-Originating-IP:
> > header of the client so we could tell which country it was sent
> > from. I bet it wasn't Japan.
>
> Received: header should do that as well:
>
> Received: from [37.130.224.21] by web101313.mail.kks.yahoo.co.jp via HTTP;
> Sat, 06 May 2017 21:41:47 JST
>
> Hosting Services Inc, GB
>
> I did test SA run and it did parse the header.
>
> > > > The funny thing is, that there is a @gmail.com address in both the
> > > > 'From:' and 'Return-Path:' headers, but a @yahoo.com address in the
> > > > 'Reply-To:' and 'Sender:' headers.
> > > > Somehow Yahoo sees no problem in that and is happy to DKIM sign those
> > > > emails with a correct *Yahoo* signature.
> >
> > > I wonder why didn't THE mail hit SPF_SOFTFAIL, since it was supposed to...
> >
> > The email didn't go through a Google mail server and the envelope-from
> > was yahoo.co.jp so SPF should have passed based on IP 183.79.57.110.
>
> Return-Path: <ha...@gmail.com>
>
> that's not yahoo address (Return-Path is set to envelope from by MTAs).
>
> Also, the mail SHOULD hit SPF_* rule, if the SPF plugin is loaded, but there's none.
>
> maybe because:
>
> May 6 22:19:09.740 [30047] dbg: spf: relayed through one or more trusted relays, cannot use header-based Envelope-From, skipping
>
> ... caused by Received: line containing localhost. the OP should set up spf
> policyd on valhalla.nano-srv.net...
>
>
> > > yes: while we can agree that gmail.com is not yahoo's domain, how can DKIM
> > > validator know?
> >
> > Yahoo should stop allowing their webmail interface to control the From:
> > and Return-Path: headers. I bet this spammer tried to send the email out
> > from Google which blocked it so this is a way to abuse the Yahoo mail servers
> > that are not good at blocking the outbound spam.
>
> I doubt Return-Path was set by the sending user, I believe it was set from
> envelope from.
>
> I'm listening if you can proove the opposite.
>
> > > I don't think this problem lies at DKIM verification, more on
> > > trustworthinedd of yahoo who signs such mail,
> > > and the fact of missing SPF checks that I pointed out above.
> >
> > DKIM does authentication and this email was from Yahoo. Note no
> > DKIM_VALID_AU since the From: header was gmail.com.
>
> > > that is in fact change in requirements on DKIM itself...
> >
> > I bet as we see DMARC gain traction like SPF has this will force these
> > major mail hosting providers like Yahoo to shape up. Right now they are
> > so big that we can't make them act responsibly. Yahoo should start rejecting
> > email that is sent through them like this to prevent spammers abusing them.
> >
> > Google is slowly turning up the heat with DMARC which forces the Internet
> > to implement it. I know this is a pain but I went through this pain a few years
> > ago and now I am glad to see Google using their influence for good. In a few
> > more years all of our spam filtering will be better because of this.
>
> Still - this this is not a problem of DKIM itself and comparing DKIM domain
> with envelope from will not fix that - it will only break other forwards.
>
> For now the main problem at receiver's side seems to be missing SPF results.
>
> --
> Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
> Warning: I wish NOT to receive e-mail advertising to this address.
> Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
> M$ Win's are shit, do not use it !
--
Re: Strict/Relaxed DKIM alignment possible with SA?
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
>>On 06.05.17 15:49, Thore Boedecker wrote:
>>>After looking at the headers it became clear what the issue was:
>>>
>>>It seems that Yahoo (at least yahoo.co.jp) is allowing emails from
>>>@gmail.com senders to be sent through their servers.
>From: Matus UHLAR - fantomas <uh...@fantomas.sk>
>>@gmail.com From: and envelope from. Sender: was yahoo...
On 06.05.17 17:55, David Jones wrote:
>The headers imply that this was sent from the Yahoo webmail
>interface which must allow users to setup an "identity" like
>Thunderbird does that allows custom From: and Return-Path:
>headers. They shouldn't allow this in their webmail interface.
They should not, but this has nothing to do with the DKIM itself.
>BTW, their webmail interface should also add an X-Originating-IP:
>header of the client so we could tell which country it was sent
>from. I bet it wasn't Japan.
Received: header should do that as well:
Received: from [37.130.224.21] by web101313.mail.kks.yahoo.co.jp via HTTP;
Sat, 06 May 2017 21:41:47 JST
Hosting Services Inc, GB
I did test SA run and it did parse the header.
>>>The funny thing is, that there is a @gmail.com address in both the
>>>'From:' and 'Return-Path:' headers, but a @yahoo.com address in the
>>>'Reply-To:' and 'Sender:' headers.
>>>Somehow Yahoo sees no problem in that and is happy to DKIM sign those
>>>emails with a correct *Yahoo* signature.
>
>>I wonder why didn't THE mail hit SPF_SOFTFAIL, since it was supposed to...
>
>The email didn't go through a Google mail server and the envelope-from
>was yahoo.co.jp so SPF should have passed based on IP 183.79.57.110.
Return-Path: <ha...@gmail.com>
that's not yahoo address (Return-Path is set to envelope from by MTAs).
Also, the mail SHOULD hit SPF_* rule, if the SPF plugin is loaded, but there's none.
maybe because:
May 6 22:19:09.740 [30047] dbg: spf: relayed through one or more trusted relays, cannot use header-based Envelope-From, skipping
... caused by Received: line containing localhost.
the OP should set up spf policyd on valhalla.nano-srv.net...
>>yes: while we can agree that gmail.com is not yahoo's domain, how can DKIM
>>validator know?
>
>Yahoo should stop allowing their webmail interface to control the From:
>and Return-Path: headers. I bet this spammer tried to send the email out
>from Google which blocked it so this is a way to abuse the Yahoo mail servers
>that are not good at blocking the outbound spam.
I doubt Return-Path was set by the sending user, I believe it was set from
envelope from.
I'm listening if you can proove the opposite.
>>I don't think this problem lies at DKIM verification, more on
>>trustworthinedd of yahoo who signs such mail,
>>and the fact of missing SPF checks that I pointed out above.
>
>DKIM does authentication and this email was from Yahoo. Note no
>DKIM_VALID_AU since the From: header was gmail.com.
>>that is in fact change in requirements on DKIM itself...
>
>I bet as we see DMARC gain traction like SPF has this will force these
>major mail hosting providers like Yahoo to shape up. Right now they are
>so big that we can't make them act responsibly. Yahoo should start rejecting
>email that is sent through them like this to prevent spammers abusing them.
>
>Google is slowly turning up the heat with DMARC which forces the Internet
>to implement it. I know this is a pain but I went through this pain a few years
>ago and now I am glad to see Google using their influence for good. In a few
>more years all of our spam filtering will be better because of this.
Still - this this is not a problem of DKIM itself and comparing DKIM domain
with envelope from will not fix that - it will only break other forwards.
For now the main problem at receiver's side seems to be missing SPF results.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
M$ Win's are shit, do not use it !
Re: Strict/Relaxed DKIM alignment possible with SA?
Posted by David Jones <dj...@ena.com>.
From: Matus UHLAR - fantomas <uh...@fantomas.sk>
>On 06.05.17 15:49, Thore Boedecker wrote:
>>After looking at the headers it became clear what the issue was:
>>
>>It seems that Yahoo (at least yahoo.co.jp) is allowing emails from
>>@gmail.com senders to be sent through their servers.
>@gmail.com From: and envelope from. Sender: was yahoo...
The headers imply that this was sent from the Yahoo webmail
interface which must allow users to setup an "identity" like
Thunderbird does that allows custom From: and Return-Path:
headers. They shouldn't allow this in their webmail interface.
BTW, their webmail interface should also add an X-Originating-IP:
header of the client so we could tell which country it was sent
from. I bet it wasn't Japan.
>>The funny thing is, that there is a @gmail.com address in both the
>>'From:' and 'Return-Path:' headers, but a @yahoo.com address in the
>>'Reply-To:' and 'Sender:' headers.
>>Somehow Yahoo sees no problem in that and is happy to DKIM sign those
>>emails with a correct *Yahoo* signature.
>I wonder why didn't THE mail hit SPF_SOFTFAIL, since it was supposed to...
The email didn't go through a Google mail server and the envelope-from
was yahoo.co.jp so SPF should have passed based on IP 183.79.57.110.
>>Over on my side, the receiving end of these emails, there is my
>>spamassassin. SA discovers the DKIM signature and is able to validate
>>this signature against the Yahoo server which is totally undesirable
>>in my opinion.
>>Maybe strict DKIM alignment is not always the best choice, because
>>sometimes the emails are signed by different servers without sharing
>>one signing key for the entire domain.
>yes: while we can agree that gmail.com is not yahoo's domain, how can DKIM
>validator know?
Yahoo should stop allowing their webmail interface to control the From:
and Return-Path: headers. I bet this spammer tried to send the email out
from Google which blocked it so this is a way to abuse the Yahoo mail servers
that are not good at blocking the outbound spam.
>I don't think this problem lies at DKIM verification, more on
>trustworthinedd of yahoo who signs such mail,
>and the fact of missing SPF checks that I pointed out above.
DKIM does authentication and this email was from Yahoo. Note no
DKIM_VALID_AU since the From: header was gmail.com.
>>So is there any way to make SA perform at least a relaxed DKIM
>>alignment check on the headers so that the DKIM signature domain has
>>to belong to the 'From:' address?
>every domain using yahoo mail servers would have to delegate DKIM to
>yahoo and yahoo would need to sign under all those domains.
>the same applies about any domain that does DKIM signing (e.g. gmail)
Interestingly, _dmarc.yahoo.com TXT record has "p=reject" which would
have caused a DMARC fail with a bounce. Looks like this spammer noticed
that yahoo.co.jp does not have a DMARC record which allowed them to
send this spam even to recipients with DMARC checks enabled and honoring
"p=reject" like my mails filters do.
>that is in fact change in requirements on DKIM itself...
I bet as we see DMARC gain traction like SPF has this will force these
major mail hosting providers like Yahoo to shape up. Right now they are
so big that we can't make them act responsibly. Yahoo should start rejecting
email that is sent through them like this to prevent spammers abusing them.
Google is slowly turning up the heat with DMARC which forces the Internet
to implement it. I know this is a pain but I went through this pain a few years
ago and now I am glad to see Google using their influence for good. In a few
more years all of our spam filtering will be better because of this.
Re: Strict/Relaxed DKIM alignment possible with SA?
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 06.05.17 15:49, Thore Boedecker wrote:
>After looking at the headers it became clear what the issue was:
>
>It seems that Yahoo (at least yahoo.co.jp) is allowing emails from
>@gmail.com senders to be sent through their servers.
@gmail.com From: and envelope from. Sender: was yahoo...
>The funny thing is, that there is a @gmail.com address in both the
>'From:' and 'Return-Path:' headers, but a @yahoo.com address in the
>'Reply-To:' and 'Sender:' headers.
>Somehow Yahoo sees no problem in that and is happy to DKIM sign those
>emails with a correct *Yahoo* signature.
I wonder why didn't THE mail hit SPF_SOFTFAIL, since it was supposed to...
>Over on my side, the receiving end of these emails, there is my
>spamassassin. SA discovers the DKIM signature and is able to validate
>this signature against the Yahoo server which is totally undesirable
>in my opinion.
>Maybe strict DKIM alignment is not always the best choice, because
>sometimes the emails are signed by different servers without sharing
>one signing key for the entire domain.
yes: while we can agree that gmail.com is not yahoo's domain, how can DKIM
validator know?
I don't think this problem lies at DKIM verification, more on
trustworthinedd of yahoo who signs such mail,
and the fact of missing SPF checks that I pointed out above.
>So is there any way to make SA perform at least a relaxed DKIM
>alignment check on the headers so that the DKIM signature domain has
>to belong to the 'From:' address?
every domain using yahoo mail servers would have to delegate DKIM to
yahoo and yahoo would need to sign under all those domains.
the same applies about any domain that does DKIM signing (e.g. gmail)
that is in fact change in requirements on DKIM itself...
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
I'm not interested in your website anymore.
If you need cookies, bake them yourself.