On 25/04/24 19:42, Benny Pedersen via Postfix-users wrote:
Peter via Postfix-users skrev den 2024-04-25 09:19:
On 15/04/24 10:14, Benny Pedersen via Postfix-users wrote:
Authentication-Results list.sys4.de; dkim=pass
header.d=porcupine.org; arc=none (Message is not ARC signed);
dmarc=pass (Used From Domain Record) header.from=porcupine.org
policy.dmarc=none
What does this have to to with Postfix, or even the Postfix mailing
list? You're posting headers coming from Wietse's personal email, not
the list itself.
No, score=-3.3 tagged_above=-999 required=5 tests=[AUTHRES_ARC_NONE=0.5,
AUTHRES_DKIM_PASS=-0.5, AUTHRES_DMARC_PASS=-0.5, DKIM_SIGNED=0.1,
DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,
MAILING_LIST_MULTI=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_PASS=-0.1,
SPF_PASS=-0.1] autolearn=unavailable autolearn_force=no
I see here a bunch of tests passing (and lowering the SPAM score as a
result) with the exception of ARC which this says is missing alltogether
which is puzzling because the list certainly adds ARC headers. I fail
to see how this has anything to do with your above claims and only adds
to the confusion of, "what the heck are you talking about?".
from authres perspective maillists can not be dmarc aligned, we all have
to live with unalined maillist members
postfix.org appears to be missing a _dmarc record. This is the only
reason why it's not DMARC aligned and is not actually a failure. Both
SPF and DKIM pass with alignment to the From: header of every message on
this mailing list, so with the exception of the missing DNS record it is
certainly DMARC aligned.
dmarc can't be aligned with this missing,
This is just plain wrong. DMARC will align just fine with SPF missing
if DKIM is correct and signed by the From: header domain.
i am not sure with this, maybe you will enligtment me on this case ?
https://datatracker.ietf.org/doc/html/rfc7489#page-13
"A message satisfies the DMARC checks if at least one of the supported
authentication mechanisms:..."
"One of" means that either SPF *or* DKIM has to pass and be in
alignment, not both of them. If you have have some app that is
reporting DMARC failure because SPF is missing even though DKIM passes
and is in alignment then that app is wrong.
not specifik anyone here, its imho just a fail that does not exits on
dovecot maillist if you note the diffrent ?
I'm not going to go comparing the two lists. I don't have problems with
any messages from this list failing, and my analysis shows me that they
are all correct.
The list software re-signs the message from postfix.org and the
envelope sender and From: header are all changed to postfix.org so
it's all in alignment.
resigns is a workaround on maillist that breaks dkim on purpose, if
maillist or plain forwarders did not break dkim we won't need arc to fix
any problems
Re-signing doesn't break DKIM, the DKIM is broken because certain
headers and the body are changed. Neither is it a workaround, it's
simply taking ownership of the message as if the list server is the
originator and as such the reputation of the list server becomes
attached to the message instead of the original sender.
Just to be clear, both porcupine.org and postfix.org have SPF and DKIM
policies and Wietse's messages pass both when passing through the list.
this is fine, but arc sign, arc seal does not care on direkt mails
The list ARC signs messages as well. There is no reason for a message
that is direct from the original sender to be ARC signed as
spamassassin DKIM_VALID_EF is maybe just a hack to track dmarc aligment
without dmarc at all ? :=)
DKIM_VALID_EF tracks the *envelope* From alignment, which is different
to the From: header alignment. The envelope From alignment does not
affect DMARC.
i just hope postfix.org and sys4 does as best as dovecot maillist do
with spf
*Sigh* ...and yet you cannot even show an actual problem.
Peter
_______________________________________________
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org
