<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div class="">
<div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;">Thanks</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class=""></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;">Sten</div>
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On 26 Jan 2022, at 17.14, Matus UHLAR - fantomas <<a href="mailto:uhlar@fantomas.sk" class="">uhlar@fantomas.sk</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class=""><blockquote type="cite" class=""><blockquote type="cite" class="">On Jan 25, 2022, at 8:50 AM, Benny Pedersen <<a href="mailto:me@junc.eu" class="">me@junc.eu</a>> wrote:<br class="">Authentication-Results: <a href="http://lists.isc.org" class="">lists.isc.org</a>;<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=<a href="http://isc.org" class="">isc.org</a> <a href="mailto:header.i=@isc.org" class="">header.i=@isc.org</a> header.b=q/vOEba5;<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=<a href="http://isc.org" class="">isc.org</a> <a href="mailto:header.i=@isc.org" class="">header.i=@isc.org</a> header.b=ozeUkO/Z<br class=""></blockquote></blockquote><br class="">On 25.01.22 12:25, Dan Mahoney wrote:<br class=""><blockquote type="cite" class="">The headers you cite are lying to you. :) The message passed DKIM on the<br class="">way IN to <a href="http://lists.isc.org" class="">lists.isc.org</a> (the dedicated vm that runs our lists), but then,<br class="">when the message got to the mailman python scripts and then shot back out<br class="">via the MTA, they had an altered body and no longer passed, and the header<br class="">was rewritten to say "fail". (This is visible from the logging on the<br class="">servers, but nowhere else).<br class=""></blockquote><br class="">there were multiple headers when that mail came here:<br class=""><br class="">Authentication-Results: <a href="http://fantomas.fantomas.sk" class="">fantomas.fantomas.sk</a>;<br class=""> dkim=fail reason="signature verification failed" (1024-bit key; secure) header.d=<a href="http://isc.org" class="">isc.org</a> <a href="mailto:header.i=@isc.org" class="">header.i=@isc.org</a> header.b="q/vOEba5";<br class=""> dkim=fail reason="signature verification failed" (1024-bit key; secure) header.d=<a href="http://isc.org" class="">isc.org</a> <a href="mailto:header.i=@isc.org" class="">header.i=@isc.org</a> header.b="ozeUkO/Z";<br class=""> dkim-atps=neutral<br class="">Authentication-Results: <a href="http://lists.isc.org" class="">lists.isc.org</a>;<br class=""> dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=<a href="http://isc.org" class="">isc.org</a> <a href="mailto:header.i=@isc.org" class="">header.i=@isc.org</a> header.b=q/vOEba5;<br class=""> dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=<a href="http://isc.org" class="">isc.org</a> <a href="mailto:header.i=@isc.org" class="">header.i=@isc.org</a> header.b=ozeUkO/Z<br class=""><br class="">obviously when the mail came to list, DKIM was fine, not so after it left<br class="">(thanks to list signature)<br class=""><br class=""><blockquote type="cite" class=""><blockquote type="cite" class="">will my dkim fail aswell ?<br class=""></blockquote></blockquote><br class="">it did...<br class=""><br class=""><blockquote type="cite" class="">Altering the body or headers at all (whch lists do) will often break the<br class="">hashing. For this reason, most recent versions of mailman have an option<br class="">to rewrite your mail from:<br class=""></blockquote></div></div></blockquote><div><br class=""></div>When the dkim is set up, you can select which parts of the header you want to include in the signature.</div><div><br class=""></div><div>I have selected a smaller part of the headers for my signature, so does this go through?</div><div><br class=""><blockquote type="cite" class=""><div class=""><div class=""><br class="">[...]<br class=""><br class=""><blockquote type="cite" class="">...but only in the event you have a restrictive DMARC policy. <br class=""></blockquote><br class="">this explains why both your and Benny's mail did fail here, while Eduard's<br class="">did not - that one was signed by mailman because of his domains' restrictive<br class="">policy.<br class=""><br class="">I missed this part before.<br class=""><br class=""><blockquote type="cite" class="">I've argued that it should be possible to do so for *any* dmarc policy,<br class="">even p=none, but that option is not present in mailman 3, at least.<br class=""></blockquote><br class="">I agree.<br class="">spam filter is something that can use dkim fail and should not be ignored.<br class=""><br class="">-- <br class="">Matus UHLAR - fantomas, <a href="mailto:uhlar@fantomas.sk" class="">uhlar@fantomas.sk</a> ; <a href="http://www.fantomas.sk/" class="">http://www.fantomas.sk/</a><br class="">Warning: I wish NOT to receive e-mail advertising to this address.<br class="">Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.<br class="">Support bacteria - they're the only culture some people have.<br class="">_______________________________________________<br class="">Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" class="">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br class=""><br class="">ISC funds the development of this software with paid support subscriptions. Contact us at <a href="https://www.isc.org/contact/" class="">https://www.isc.org/contact/</a> for more information.<br class=""><br class=""><br class="">bind-users mailing list<br class=""><a href="mailto:bind-users@lists.isc.org" class="">bind-users@lists.isc.org</a><br class="">https://lists.isc.org/mailman/listinfo/bind-users<br class=""></div></div></blockquote></div><br class=""></body></html>