Re: Why does SPF fail sometimes?

2014-12-15 Thread Benny Pedersen
On 15. dec. 2014 01.19.02 Christian Rößner wrote: https://datatracker.ietf.org/doc/draft-kucherawy-dmarc-base/?include_text=1 2. Receivers compare the RFC5322 From: address in the mail to the SPF and DKIM results, if present, and the DMARC policy in DNS. Hopefully opendmarc will h

header_checks from a script

2014-12-15 Thread li...@rhsoft.net
Hi is there some way to invoke regexp:/etc/postfix/header_checks_smtpd.cf to local stored messages for strip out unwanted headers? the goal is to strip out unneeded headers froma spam corpus and anonymize the remaining ones to share the archive and Google did not bring anything i would trust

cidr:/ lookup using network map [e.g. mysql]

2014-12-15 Thread btb
hi- i currently have: postscreen_access_list = cidr:$table_directory/postscreen_access_list.cidr with various sized netblocks rejected therein. this all works fine. i have more than one mx, and would like to store this data in a centralized location and query over the network instead of dupl

Re: Why does SPF fail sometimes?

2014-12-15 Thread A. Schulze
wietse: DMARC "verifies" the From: header against SPF, DKIM or both, but only a poorly-informed person would require that the From: address *always* verifies with SPF. for that reason it's more important the existing DKIM signature is still valid when the mlm redistribute the message to all s

Re: Why does SPF fail sometimes?

2014-12-15 Thread Benny Pedersen
On 15. dec. 2014 00.21.30 Christian Rößner wrote: Thanks. That was what I thought. People using the header-from field. But I couldn’t believe that. But now that you gave me this feedback, I think this might be the reason. opendmarc links to libspf2, with in some versions checks sender-id, i

Re: Why does SPF fail sometimes?

2014-12-15 Thread lst_hoe02
Zitat von "James B. Byrne" : On Sun, December 14, 2014 20:05, Richard Damon wrote: DMARC says that if a domain requests DMARC protection then any message that has a RFC5322 domain pointing to it, must be verifiable as coming from that domain, thus such an address can NOT use a 3rd party (like

Re: Why does SPF fail sometimes?

2014-12-15 Thread Darren Pilgrim
On 12/14/2014 5:05 PM, Richard Damon wrote: Other mailing list systems have adopted some work arounds for this problem, a common one is to "munge" the From: line to be the list address (and setting Reply-To: to the poster), or wrapping the message in a wrapper that is from the list, and the messa

Re: header_checks from a script

2014-12-15 Thread Viktor Dukhovni
On Mon, Dec 15, 2014 at 12:39:56PM +0100, li...@rhsoft.net wrote: > is there some way to invoke regexp:/etc/postfix/header_checks_smtpd.cf to > local stored messages for strip out unwanted headers? Have you considered postmap(1) http://www.postfix.org/postmap.1.html The "-h" option is I

Re: cidr:/ lookup using network map [e.g. mysql]

2014-12-15 Thread Wietse Venema
btb: > hi- > > i currently have: > > postscreen_access_list = cidr:$table_directory/postscreen_access_list.cidr > > with various sized netblocks rejected therein. this all works > fine. i have more than one mx, and would like to store this data > in a centralized location and query over the ne

Re: Why does SPF fail sometimes?

2014-12-15 Thread Wietse Venema
A. Schulze: > > It would be unreasonable to expect that mailing list managers replace > > the From: address of mailing list postings to match the list server's > > IP addresses. > > Ehm, > ironically that's exactly the solution preferred on the dmarc-discuss ml :-/ Folks who set up such policies

Re: Why does SPF fail sometimes?

2014-12-15 Thread Richard Damon
On 12/14/14, 10:10 PM, James B. Byrne wrote: > On Sun, December 14, 2014 20:05, Richard Damon wrote: >> DMARC says that if a domain requests DMARC protection then any >> message that has a RFC5322 domain pointing to it, must be >> verifiable as coming from that domain, thus such an address can

Re: header_checks from a script

2014-12-15 Thread li...@rhsoft.net
Am 15.12.2014 um 22:59 schrieb Viktor Dukhovni: On Mon, Dec 15, 2014 at 12:39:56PM +0100, li...@rhsoft.net wrote: is there some way to invoke regexp:/etc/postfix/header_checks_smtpd.cf to local stored messages for strip out unwanted headers? Have you considered postmap(1) http://www

Re: header_checks from a script

2014-12-15 Thread Viktor Dukhovni
On Tue, Dec 16, 2014 at 12:28:26AM +0100, li...@rhsoft.net wrote: > > Am 15.12.2014 um 22:59 schrieb Viktor Dukhovni: > >On Mon, Dec 15, 2014 at 12:39:56PM +0100, li...@rhsoft.net wrote: > > > >>is there some way to invoke regexp:/etc/postfix/header_checks_smtpd.cf to > >>local stored messages for

Re: Why does SPF fail sometimes?

2014-12-15 Thread li...@rhsoft.net
Am 15.12.2014 um 06:15 schrieb Benny Pedersen: On 15. dec. 2014 00.21.30 Christian Rößner wrote: Thanks. That was what I thought. People using the header-from field. But I couldn’t believe that. But now that you gave me this feedback, I think this might be the reason. opendmarc links to lib

Re: header_checks from a script

2014-12-15 Thread li...@rhsoft.net
Am 16.12.2014 um 00:34 schrieb Viktor Dukhovni: On Tue, Dec 16, 2014 at 12:28:26AM +0100, li...@rhsoft.net wrote: Am 15.12.2014 um 22:59 schrieb Viktor Dukhovni: On Mon, Dec 15, 2014 at 12:39:56PM +0100, li...@rhsoft.net wrote: is there some way to invoke regexp:/etc/postfix/header_checks_

Re: header_checks from a script

2014-12-15 Thread Viktor Dukhovni
On Tue, Dec 16, 2014 at 01:04:29AM +0100, li...@rhsoft.net wrote: > >>>The "-h" option is I think what you're looking for > >> > >>sounds promising - thank you for the hint! > > > >You'll need to modify the code to process the "IGNORE" action, > >rather than print it, and to print unmatched header

why always_add_missing_headers is not adding To: header?

2014-12-15 Thread Peter Volkov
Hi! always_add_missing_headers = yes was added in main.cf, restarted server and postconf reports it is there. According to documentation http://www.postfix.org/postconf.5.html#always_add_missing_headers I'm expecting to have To: header set in every e-mail, but still there is none (see below). Co

Re: header_checks from a script

2014-12-15 Thread li...@rhsoft.net
Am 16.12.2014 um 01:09 schrieb Viktor Dukhovni: On Tue, Dec 16, 2014 at 01:04:29AM +0100, li...@rhsoft.net wrote: The "-h" option is I think what you're looking for sounds promising - thank you for the hint! You'll need to modify the code to process the "IGNORE" action, rather than print it

Re: why always_add_missing_headers is not adding To: header?

2014-12-15 Thread li...@rhsoft.net
Am 16.12.2014 um 01:14 schrieb Peter Volkov: always_add_missing_headers = yes was added in main.cf, restarted server and postconf reports it is there. According to documentation http://www.postfix.org/postconf.5.html#always_add_missing_headers I'm expecting to have To: header set in every e-mail

Re: postfix smtpd processes ballooning from L4 health checks

2014-12-15 Thread Jorgen Lundman
wie...@porcupine.org (Wietse Venema) wrote: > The Postfix process count corresponds to the number of client > sessions. If the number of processes goes up, either the number > of clients goes up or the sessions last longer, i.e. clients aren't > closing the connection. You would notice that fr

Re: why always_add_missing_headers is not adding To: header?

2014-12-15 Thread Wietse Venema
Peter Volkov: > Hi! > > always_add_missing_headers = yes > was added in main.cf, restarted server and postconf reports it is there. > According to documentation > http://www.postfix.org/postconf.5.html#always_add_missing_headers > I'm expecting to have To: header set in every e-mail, but still t

Re: postfix smtpd processes ballooning from L4 health checks

2014-12-15 Thread li...@rhsoft.net
Am 16.12.2014 um 01:43 schrieb Jorgen Lundman: L4 looks to be sending "QUIT" and dropping connection, not allowing for the "221 2.0.0 Bye" reply, that ends up trying to flush. Apart from changing "smtpd_timeout" to lessen the time it takes flush to give up, are there any other options I could u

Re: why always_add_missing_headers is not adding To: header?

2014-12-15 Thread li...@rhsoft.net
Am 16.12.2014 um 01:52 schrieb Wietse Venema: Peter Volkov: always_add_missing_headers = yes was added in main.cf, restarted server and postconf reports it is there. According to documentation http://www.postfix.org/postconf.5.html#always_add_missing_headers I'm expecting to have To: header set

Re: postfix smtpd processes ballooning from L4 health checks

2014-12-15 Thread Wietse Venema
Jorgen Lundman: > 15870: 0.0001 write(11, " 2 2 0 s m t p . z e r".., 32) = 32 > 15870: 0.0006 pollsys(0x080474F8, 1, 0x080474D0, 0x) = 1 > 15870: 0. read(11, " Q U I T\r\n", 4096) = 6 > 15870: 0.0001 ioctl(11, FIONREAD, 0x08047614) Err#13

Re: why always_add_missing_headers is not adding To: header?

2014-12-15 Thread Wietse Venema
li...@rhsoft.net: > Am 16.12.2014 um 01:52 schrieb Wietse Venema: > > Peter Volkov: > >> always_add_missing_headers = yes > >> was added in main.cf, restarted server and postconf reports it is there. > >> According to documentation > >> http://www.postfix.org/postconf.5.html#always_add_missing_head

Re: why always_add_missing_headers is not adding To: header?

2014-12-15 Thread Wietse Venema
Wietse Venema: > li...@rhsoft.net: > > Am 16.12.2014 um 01:52 schrieb Wietse Venema: > > > Peter Volkov: > > >> always_add_missing_headers = yes > > >> was added in main.cf, restarted server and postconf reports it is there. > > >> According to documentation > > >> http://www.postfix.org/postconf.5

Re: Why does SPF fail sometimes?

2014-12-15 Thread Richard Damon
On 12/15/14, 4:24 AM, A. Schulze wrote: wietse: DMARC "verifies" the From: header against SPF, DKIM or both, but only a poorly-informed person would require that the From: address *always* verifies with SPF. for that reason it's more important the existing DKIM signature is still valid when

Re: Why does SPF fail sometimes?

2014-12-15 Thread James B. Byrne
On Sun, December 14, 2014 23:09, Richard Damon wrote: > > I regularly get important messages from Financial Institutions. > Yes, they will typically ask me to log into their web site for confirmation > of the message or to send "sensitive" information, but they do > send notices by email that they

Re: cidr:/ lookup using network map [e.g. mysql]

2014-12-15 Thread btb
On Dec 15, 2014, at 17.47, Wietse Venema wrote: > btb: >> hi- >> >> i currently have: >> >> postscreen_access_list = cidr:$table_directory/postscreen_access_list.cidr >> >> with various sized netblocks rejected therein. this all works >> fine. i have more than one mx, and would like to store

Re: cidr:/ lookup using network map [e.g. mysql]

2014-12-15 Thread Peter
On 12/16/2014 07:22 AM, btb wrote: > with various sized netblocks rejected therein. this all works fine. > i have more than one mx, and would like to store this data in a > centralized location and query over the network instead of > duplicating the files on each mx. i don't believe postfix can >

Re: cidr:/ lookup using network map [e.g. mysql]

2014-12-15 Thread Quanah Gibson-Mount
--On Monday, December 15, 2014 11:23 PM -0500 b...@bitrate.net wrote: for sql though, i envisioned a query that would return the same data that would be read from the text file, a list of patterns and a matching result for each, for postfix to iterate through. i know this would be a different

Re: why always_add_missing_headers is not adding To: header?

2014-12-15 Thread Peter Volkov
Hi! В Вт, 16/12/2014 в 01:28 +0100, li...@rhsoft.net пишет: > Am 16.12.2014 um 01:14 schrieb Peter Volkov: > > always_add_missing_headers = yes > > was added in main.cf, restarted server and postconf reports it is there. > > According to documentation > > http://www.postfix.org/postconf.5.html#alw

Re: why always_add_missing_headers is not adding To: header?

2014-12-15 Thread Peter Volkov
Hi, Wietse! В Пн, 15/12/2014 в 20:24 -0500, Wietse Venema пишет: > Wietse Venema: > > li...@rhsoft.net: > > > Am 16.12.2014 um 01:52 schrieb Wietse Venema: > > > > Peter Volkov: > > > >> always_add_missing_headers = yes > > > >> was added in main.cf, restarted server and postconf reports it is >

Re: cidr:/ lookup using network map [e.g. mysql]

2014-12-15 Thread Benny Pedersen
On 16. dec. 2014 05.24.09 b...@bitrate.net wrote: i'll have to think more about this. 1: rsync replication && postfix reload 2: postgresql replication && live replicate in postgresql Option 2 just need postgresql in postfix since postgresql support cidr natively Option 1 is damm simple