<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Jan 25, 2022, at 8:50 AM, Benny Pedersen <<a href="mailto:me@junc.eu" class="">me@junc.eu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">On 2022-01-25 17:45, Greg Choules wrote:<br class=""><blockquote type="cite" class="">Hello.<br class=""></blockquote><br class="">Authentication-Results: <a href="http://lists.isc.org" class="">lists.isc.org</a>;<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=<a href="http://isc.org" class="">isc.org</a> <a href="mailto:header.i=@isc.org" class="">header.i=@isc.org</a> header.b=q/vOEba5;<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=<a href="http://isc.org" class="">isc.org</a> <a href="mailto:header.i=@isc.org" class="">header.i=@isc.org</a> header.b=ozeUkO/Z<br class=""><br class="">dont know why it failed<br class=""></div></div></blockquote><div><br class=""></div>I may as well answer this since other people chimed in on the test message. <span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">I'm Dan Mahoney, ISC's sysadmin who runs most of our mail systems, and, coincidentally, also do some work with the Trusted Domain Project on opendkim and opendmarc.</span><div><br class=""></div><div>The headers you cite are lying to you. :) The message passed DKIM on the way IN to <a href="http://lists.isc.org" class="">lists.isc.org</a> (the dedicated vm that runs our lists), but then, when the message got to the mailman python scripts and then shot back out via the MTA, they had an altered body and no longer passed, and the header was rewritten to say "fail". (This is visible from the logging on the servers, but nowhere else).</div><div><br class=""></div><div>The solution here, is that <a href="http://lists.isc.org" class="">lists.isc.org</a> should only be running in "signer" mode, and not verifying anything (we verify messages on our MXes, and make the decisions there to reject if dmarc says to do so). The only things that <a href="http://lists.isc.org" class="">lists.isc.org</a> will sign are things that it generates itself (i.e. things from the <a href="http://lists.isc.org" class="">lists.isc.org</a> domain).</div><div><br class=""></div><blockquote type="cite" class=""><div class=""><div class=""><br class="">will my dkim fail aswell ?<br class=""></div></div></blockquote><div><br class=""></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Re: DKIM failure, both SPF and DKIM is well known to be broken by mailing lists. So if you're running a dmarc-enforced domain with a policy of P=reject, it's possible that mail you send via a list will be rejected.</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br class=""></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Altering the body or headers at all (whch lists do) will often break the hashing. For this reason, most recent versions of mailman have an option to rewrite your mail from:</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br class=""></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">From: "Benny Pedersen" <you(at)<a href="http://example.com" class="">example.com</a>></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br class=""></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">...to...</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br class=""></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">From: "Benny Pedersen via bind-users" <bind-users(at)<a href="http://lists.isc.org" class="">lists.isc.org</a>></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Reply-To: "Benny Pederson" <you(at)<a href="http://example.com" class="">example.com</a>></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Cc: <a href="mailto:bind-users@lists.isc.org" class="">bind-users@lists.isc.org</a></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br class=""></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">...but only in the event you have a restrictive DMARC policy. I've argued that it should be possible to do so for *any* dmarc policy, even p=none, but that option is not present in mailman 3, at least.</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br class=""></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Here at ISC, we have a little bit of a cheat -- messages *we* send to bind-users will pass SPF, because <a href="http://lists.isc.org" class="">lists.isc.org</a> is in our SPF list.</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br class=""></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">The upcoming "better" solution for this is ARC: basically a way for <a href="http://lists.isc.org" class="">lists.isc.org</a> to assert "This thing passed muster when it entered our borders, trust us".</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br class=""></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">-Dan Mahoney</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br class=""></div><blockquote type="cite" class=""><div class=""><div class="">_______________________________________________<br class="">Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" class="">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br class=""><br class="">ISC funds the development of this software with paid support subscriptions. Contact us at <a href="https://www.isc.org/contact/" class="">https://www.isc.org/contact/</a> for more information.<br class=""><br class=""><br class="">bind-users mailing list<br class=""><a href="mailto:bind-users@lists.isc.org" class="">bind-users@lists.isc.org</a><br class="">https://lists.isc.org/mailman/listinfo/bind-users<br class=""></div></div></blockquote></div><br class=""></body></html>