[SAC] [postgis-devel] DMARC/DKIM mitigation on maling lists

[Greg Troxel]

Sandro Santilli <strk at kbt.io> writes:

>> Ok, this is now live for postgis-tickets. I had to:
>> 
>>   1. Set "Replace the From" to "no"
>>      https://lists.osgeo.org/mailman/admin/postgis-tickets/general
>> 
>>   2. Disable "Reply-to" munging
>>      https://lists.osgeo.org/mailman/admin/postgis-tickets/general
>> 
>>   3. Remove footer from the non-digest options
>>      https://lists.osgeo.org/mailman/admin/postgis-tickets/nondigest
>> 
>> You can see the subsequente differences from the archive:
>> https://lists.osgeo.org/pipermail/postgis-tickets/2023-October/date.html
>
> Laurențiu (in Cc) tested sending a DKIM-signed email to the
> postgis-tickets configured as mentioned above and the mail was found
> to still break the DKIM signature.
>
> Here's what I get as Authentication-Results header when the mail arrives
> to my mailbox:
>
> 	Authentication-Results:
> 		dkim=fail ("headers rsa verify failed") header.d=dend.ro header.s=fm2 header.b="HQmGmY/I";
> 		dkim=fail ("headers rsa verify failed") header.d=messagingengine.com header.s=fm3 header.b=o8qZA0x2;
> 		dmarc=fail reason="SPF not aligned (relaxed)" header.from=dend.ro (policy=quarantine);
> 		spf=pass
>
> Magnus: if we wanted to compare with PostgreSQL lits, would any of
> those lists be good test targets ? 
>
> Does anyone know if this the DKIM failures above could still have to do with
> mailman configuration ?

I think the way to debug this is to store both the original message as
it went to the mailman server and the one as delivered and then diff
them.  I have had some success guessing at what was munged and finding a
version that passed, but diff is really vastly easier.

I find it odd for outgoing mail from people to have Sender: as for
normal human-sent mail, it should just be From:.  And, I would not
really expect Sender: to be covered by DKIM.  I just sent a normal email
to another person, and my outgoing DKIM header is

  h=From:To:Cc:Subject:References:Date:In-Reply-To;

(I am still in the process of subscribing here, so please keep me in cc
for now.)