You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Chris Purves <ch...@northfolk.ca> on 2006/10/17 17:16:14 UTC
domainkeys unverified
I just got the domainkeys plugin set up, but it's not working the way I
expect.
In messages from Yahoo I see:
0.0 DK_SIGNED Domain Keys: message has an unverified signature
but I never see DK_VERIFIED
Is there something I need to configure? I didn't apply the patch,
because I'm assuming it's been incorporated into 3.1.4.
--
Chris
Re: domainkeys unverified - solved
Posted by Chris Purves <ch...@northfolk.ca>.
Peter H. Lemieux wrote:
> Chris Purves wrote:
>> In the end, with the help of Mark Martinec, I was able to determine
>> that the problem was with my ISP provided DNS namerservers not
>> allowing full TXT records to be returned (they were truncated).
>
> Was this something that the ISP cooked up, or was it intrinsic to the
> DNS server software they are using? If the latter, it would be good to
> know which server they were running. It might be a useful addition to
> the FAQ/wiki.
>
I still have to contact them, but I'll post back with my results.
--
Chris
Re: domainkeys unverified - solved
Posted by "Peter H. Lemieux" <ph...@cyways.com>.
Chris Purves wrote:
> In the end, with the help of Mark Martinec, I was able to determine that
> the problem was with my ISP provided DNS namerservers not allowing full
> TXT records to be returned (they were truncated).
Was this something that the ISP cooked up, or was it intrinsic to the DNS
server software they are using? If the latter, it would be good to know
which server they were running. It might be a useful addition to the
FAQ/wiki.
Peter
RE: domainkeys unverified - solved
Posted by Mark <ad...@asarian-host.net>.
> -----Original Message-----
> From: Chris Purves [mailto:chris@northfolk.ca]
> Sent: zaterdag 28 oktober 2006 0:49
> To: users@spamassassin.apache.org
> Subject: Re: domainkeys unverified - solved
>
>
> >> DK_VERIFIED does not fire for Yahoo! e-mails (multiple part
> >> TXT record)
> >
> > Interesting.
> >
> > nslookup -q=txt lima._domainkey.yahoogroups.com
> >
> > "k=rsa;
> >
> > p=MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAL10WHRWMSb9Tnl+k4Kzpc18rDCT
> > pDT1pbK0xwkd
> > ZIZkaP8NB75qa/S57xccZlIwbI22Ooy/IY+8WxQtvE2z4W"
> > "LLNOf9hkMeicUH48TGkEoCAcaSjJz/b3NMrOy9l1U7gQIDAP//"
> >
> > I get two parts, too. Is that their correct public key,
> > when concatinated?
> What you get is correct. In my case, when it's not working I get:
>
> chris@aurora:~$ nslookup -q=txt lima._domainkey.yahoogroups.com
> Server: 64.59.184.13
> Address: 64.59.184.13#53
>
> Non-authoritative answer:
> lima._domainkey.yahoogroups.com text = "k=rsa\;
> p=MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAL10WHRWMSb9Tnl+k4Kzpc18rDCT
> pDT1pbK0xwkdZIZkaP8NB75qa/S57xccZlIwbI22Ooy/IY+8WxQtvE2z4W"
>
> Authoritative answers can be found from:
>
> chris@aurora:~$
>
> I'm missing the second part of the "Answer" and "Authority" is empty.
Thanks. :) I was getting worried. I'm not quite ready to go to BIND 9 yet
(don't all y'all shoot me now), so I'm happy to hear it's working.
- Mark
Re: domainkeys unverified - solved
Posted by Chris Purves <ch...@northfolk.ca>.
Mark wrote:
>
>> -----Original Message-----
>> From: Chris Purves [mailto:chris@northfolk.ca]
>> Sent: vrijdag 27 oktober 2006 23:20
>> To: users@spamassassin.apache.org
>> Subject: Re: domainkeys unverified - solved
>>
>>
>> In the end, with the help of Mark Martinec, I was able to
>> determine that the problem was with my ISP provided DNS
>> namerservers not allowing full TXT records to be returned
>> (they were truncated).
>
>> Symptoms for this problem were:
>>
>> DK_VERIFIED does not fire for Yahoo! e-mails (multiple part
>> TXT record)
>
> Interesting.
>
> nslookup -q=txt lima._domainkey.yahoogroups.com
>
> "k=rsa;
> p=MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAL10WHRWMSb9Tnl+k4Kzpc18rDCTpDT1pbK0xwkd
> ZIZkaP8NB75qa/S57xccZlIwbI22Ooy/IY+8WxQtvE2z4W"
> "LLNOf9hkMeicUH48TGkEoCAcaSjJz/b3NMrOy9l1U7gQIDAP//"
>
> I get two parts, too. Is that their correct public key, when concatinated?
> Though I do not get both parts in random order, I wonder if I would not
> have the same issue, then.
>
What you get is correct. In my case, when it's not working I get:
chris@aurora:~$ nslookup -q=txt lima._domainkey.yahoogroups.com
Server: 64.59.184.13
Address: 64.59.184.13#53
Non-authoritative answer:
lima._domainkey.yahoogroups.com text = "k=rsa\;
p=MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAL10WHRWMSb9Tnl+k4Kzpc18rDCTpDT1pbK0xwkdZIZkaP8NB75qa/S57xccZlIwbI22Ooy/IY+8WxQtvE2z4W"
Authoritative answers can be found from:
chris@aurora:~$
I'm missing the second part of the "Answer" and "Authority" is empty.
Using dig -t txt ... the "Additional" section is also emtpy.
--
Chris
RE: domainkeys unverified - solved
Posted by Mark <ad...@asarian-host.net>.
> -----Original Message-----
> From: Chris Purves [mailto:chris@northfolk.ca]
> Sent: vrijdag 27 oktober 2006 23:20
> To: users@spamassassin.apache.org
> Subject: Re: domainkeys unverified - solved
>
>
> In the end, with the help of Mark Martinec, I was able to
> determine that the problem was with my ISP provided DNS
> namerservers not allowing full TXT records to be returned
> (they were truncated).
> Symptoms for this problem were:
>
> DK_VERIFIED does not fire for Yahoo! e-mails (multiple part
> TXT record)
Interesting.
nslookup -q=txt lima._domainkey.yahoogroups.com
"k=rsa;
p=MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAL10WHRWMSb9Tnl+k4Kzpc18rDCTpDT1pbK0xwkd
ZIZkaP8NB75qa/S57xccZlIwbI22Ooy/IY+8WxQtvE2z4W"
"LLNOf9hkMeicUH48TGkEoCAcaSjJz/b3NMrOy9l1U7gQIDAP//"
I get two parts, too. Is that their correct public key, when concatinated?
Though I do not get both parts in random order, I wonder if I would not
have the same issue, then.
- Mark
Re: domainkeys unverified - solved
Posted by Chris Purves <ch...@northfolk.ca>.
Chris Purves wrote:
> I just got the domainkeys plugin set up, but it's not working the way I
> expect.
>
> In messages from Yahoo I see:
>
> 0.0 DK_SIGNED Domain Keys: message has an unverified signature
>
> but I never see DK_VERIFIED
>
> Is there something I need to configure? I didn't apply the patch,
> because I'm assuming it's been incorporated into 3.1.4.
>
In the end, with the help of Mark Martinec, I was able to determine that
the problem was with my ISP provided DNS namerservers not allowing full
TXT records to be returned (they were truncated).
I installed bind9 and used localhost as my primary nameserver and now I
can get DK_VERIFIED.
Symptoms for this problem were:
DK_VERIFIED does not fire for Yahoo! e-mails (multiple part TXT record)
DK_VERIFIED does fire for Gmail e-mail (single part TXT record)
Perl modules Mail::DomainKeys and Mail::DKIM will fail during make test
--
Chris
Re: domainkeys unverified
Posted by Mark Martinec <Ma...@ijs.si>.
> Thanks for reminding me to prepare a version of my patch for this version.
> Part of my patch for 0.86 was already incorporated into 0.88, but not all.
> I also noticed an additional (marginal) problem, so I'll report later
> on a solution.
Here is an updated patch for Mail::DomainKeys that applies to 0.88:
http://www.ijs.si/software/amavisd/Mail-DomainKeys-0.88-mark.patch
Compared to my previous patch to 0.86, it:
- still provides a change which allows a DK policy to accept either
a "Sender:" or a "From:" header field (needed when a mailing list
supplies its own Sender, but keeps original signature intact);
- no longer applies a fix to DomainKeys/Header.pm, it is already in 0.88;
- new fix: supplies a default "o=~" when policy record is present but
does not supply "o" tag (default should apply, as per DK draft);
While at it, I also made small improvements to SA plugin DomainKeys
for better maintainability (more informative debug) and draft
compliance. I submitted the patch to SA bug tracker:
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5140
Mark
Re: domainkeys unverified
Posted by Mark Martinec <Ma...@ijs.si>.
Chris,
> > Okay, I installed Mail::DomainKeys 0.88 from CPAN.
Thanks for reminding me to prepare a version of my patch for this version.
Part of my patch for 0.86 was already incorporated into 0.88, but not all.
I also noticed an additional (marginal) problem, so I'll report later
on a solution.
> > I sent a message
> > directly from a Yahoo account to my mail server and now I see:
> > Still no DK_VERIFIED
Hmm, don't know, I see genuine mail from yahoo get a DK_VERIFIED.
You may try mailing me directly from your yahoo account,
we may be able to see what went wrong.
> After sending myself a mail from gmail I see:
> * -0.0 DK_VERIFIED Domain Keys: signature passes verification
> So, it looks like everything is working with the spamassassin plugin and
> Mail::DomainKeys. Upgradding from 0.80 to 0.88 definitely helped.
Very good, thanks for trying also with the gmail.com.
Mark
Re: domainkeys unverified
Posted by Chris Purves <ch...@northfolk.ca>.
On Tuesday 17 October 2006 20:49, Chris Purves wrote:
> On Tuesday 17 October 2006 12:52, Mark Martinec wrote:
> > It is a waste of time working with versions of Mail::DomainKeys so old,
> > there will be numerous false-positive signature failures.
>
> Okay, I installed Mail::DomainKeys 0.88 from CPAN. I sent a message
> directly from a Yahoo account to my mail server and now I see:
>
> * 0.0 DK_POLICY_SIGNSOME Domain Keys: policy says domain signs some mails
> * 0.0 DK_POLICY_TESTING Domain Keys: policy says domain is testing DK
> * 0.0 DK_SIGNED Domain Keys: message has an unverified signature
>
> Still no DK_VERIFIED
After sending myself a mail from gmail I see:
* 0.0 DK_POLICY_SIGNSOME Domain Keys: policy says domain signs some mails
* 0.0 DK_POLICY_TESTING Domain Keys: policy says domain is testing DK
* 0.0 DK_SIGNED Domain Keys: message has an unverified signature
* -0.0 DK_VERIFIED Domain Keys: signature passes verification
So, it looks like everything is working with the spamassassin plugin and
Mail::DomainKeys. Upgradding from 0.80 to 0.88 definitely helped.
--
Take care,
Chris
Re: domainkeys unverified
Posted by Chris Purves <ch...@northfolk.ca>.
On Tuesday 17 October 2006 12:52, Mark Martinec wrote:
>
> It is a waste of time working with versions of Mail::DomainKeys so old,
> there will be numerous false-positive signature failures.
>
Okay, I installed Mail::DomainKeys 0.88 from CPAN. I sent a message directly
from a Yahoo account to my mail server and now I see:
* 0.0 DK_POLICY_SIGNSOME Domain Keys: policy says domain signs some mails
* 0.0 DK_POLICY_TESTING Domain Keys: policy says domain is testing DK
* 0.0 DK_SIGNED Domain Keys: message has an unverified signature
Still no DK_VERIFIED
--
Take care,
Chris
Re: domainkeys unverified
Posted by Mark Martinec <Ma...@ijs.si>.
Chris,
> No, I'm referring to the plugin patch, which according to bugzilla was
> going to be applied to 3.1.1 (so I assume I don't need to worry about
> this, since I'm using 3.1.4):
> http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4623
That patch is in the current code as far as I can tell
(looking at 3.1.7), but must have been applied for some time now.
The ticket is closed.
> I have Mail::DomainKeys 0.80, which I think should work.
It is a waste of time working with versions of Mail::DomainKeys so old,
there will be numerous false-positive signature failures.
Here is a brief list of issues fixed in the last couple of versions,
leading up to 0.86:
- folding of 'h' subfield of the DomainKey-Signature header field
not understood, leading to incorrect list of headers to be applied
to verification;
- subtag 'd' does not match subdomains;
- inappropriately unfolding of header fields when using a "simple"
canonicalization algorithm;
- incompatibility of line endings with SA plugin, completely breaking
"simple" canonicalization algorithm;
- inappropriately requires one whitespace character to be present
after a colon in a header field;
- revoke the use of Email::Address (introduced in 0.82 or thereabout)
in favour of previous Mail::Address in order to avoid endless loops
on evaluating regexp on bad mail;
And without my patch, signed messages coming through SA users
(or similar) lists will not verify, because MLM adds a Sender field.
Mark
Re: domainkeys unverified
Posted by Mark Martinec <Ma...@ijs.si>.
Chris,
> I just got the domainkeys plugin set up, but it's not working the way I
> expect. In messages from Yahoo I see:
> 0.0 DK_SIGNED Domain Keys: message has an unverified signature
> but I never see DK_VERIFIED
> Is there something I need to configure? I didn't apply the patch,
> because I'm assuming it's been incorporated into 3.1.4.
The Perl module Mail::DomainKeys is not part of SA, it is installed
separately. SA does not/can not/ apply patches to foreign modules.
Make sure you have the version Mail::DomainKeys 0.86 (or later if any),
previous versions have several bugs.
Are you referring to a patch to Mail::DomainKeys pointed to from:
http://www.ijs.si/software/amavisd/amavisd-new-docs.html#dkim
?
That patch is not yet incorporated into 0.86 (it needs to be adjusted
to play well with signing, but if you are only doing verification
from SA it does not matter). The patch allows signature to match
either a From or a Sender header field, which becomes important
for mail passing through some mailing lists like postfix-user
or SA 'users' list.
Mark