OpenDKIM - verifying mail forwarded by mailing lists

Question

I'm using OpenDKIM for verifying signed mails that are incoming to my mail server and use it as a spam addon (if dkim is broken, mail lands in Junk). However, I'm getting lot of false-positives with broken DKIM (signature verification failed), for which main cause is mailing lists software, which adds its own headers/modify content etc.

I'm wondering is there any built-in feature in OpenDKIM (like whitelist) that will allow me to decrease false-positives, since it is not possible to contact every admin of every mailing list and say they have a improper setup that breaks DKIM.

Example header below:

MIME-Version: 1.0
In-Reply-To: <CAKnT5bMdetLwWU1Q4RQ_NdKDLDUgq8H0zRNawXs8rWNiXW0nVw@mail.gmail.com>
References: <CADFCDMTBhMxn+e4OJvZD7QN1joYrhCR3-CgH2weEhOSu36UkrQ@mail.gmail.com>
 <CAKnT5bMdetLwWU1Q4RQ_NdKDLDUgq8H0zRNawXs8rWNiXW0nVw@mail.gmail.com>
Date: Sun, 13 Oct 2013 00:50:32 +0300
Message-ID: <CAHyzMMutO3_4wKNT-G3=-m+bHQTiqoT74OWBNis=kMRXAPWfSg@mail.gmail.com>
Subject: Re: nothing here
From: nobody <nobody@gmail.com>
To: nobody <nobody@ubuntu.com>
Cc: "Translators, Ubuntu" <ubuntu-translators@lists.ubuntu.com>
Precedence: list
Content-Type: multipart/mixed; boundary="===============1762773400059964515=="
Errors-To: ubuntu-translators-bounces@lists.ubuntu.com
Sender: ubuntu-translators-bounces@lists.ubuntu.com

I modified above message (removed IP's and logins), so it might indeed have a broken DKIM, but originally it was untouched - only by mailing list sofware @ ubuntu.com

So again, is there a way to set up OpenDKIM to be more tolerant/ignore/verify in different way the DKIM signature for such mail?

thomasrutter · Answer 1 · 2015-07-29T00:29:36.943

There is a standard mechanism for making DKIM verification more tolerant of format modification such as by filters or relays, but it has to be done at the sending end rather than receiving, and all it does is become more tolerant of things like changes in whitespace rather than changes to the actual message. Basically you can choose between a relaxed (more tolerant) and simple (more strict) mode for both the headers and body when signing, and the verifying system later will use the appropriate mode in order to verify successfully. This can't be modified at the receiving end because it's impossible to know what the signature would have been with a different processing mode.

The signing system at the sender chooses which headers to include or exclude from the signature, so if you know that a relay or list is going to modify or remove a header, the sender should exclude that from verification.

However, given that a mailing list will usually change the message and headers, including important headers like Subject, the DKIM header from the original sender should fail verification.

Ideally, the mailing list software would be DKIM-aware and it would strip out the old DKIM header and replace it with one of its own, changing the From header accordingly, effectively now taking responsibility for the message rather than the original sender.

In the absence of this, if you are on the receiving end all you can do is whitelist particular servers.

This is a chicken and egg scenario with DKIM adoption: very few people enforce DKIM mismatches at the receiving end because it would have false positives, but this slows adoption of DKIM because there's little pressure for parties like mailing list hosts, etc, to fix these problems. Right now, if you strictly enforce DKIM mismatches at the receiving end you're still a bit of a guinea pig, even though DKIM has been in existence for years now. It seems more common for mail hosts just to use a DKIM mismatch as a factor contributing to their spam detection, which IMO is bad for DKIM adoption but I understand the chicken and egg problem behind it.

OpenDKIM - verifying mail forwarded by mailing lists

1 Answers1