Re: Spam from the list?

[Tim Woodall <debianuser@woodall.me.uk>]

On Thu, 7 Mar 2024, Andy Smith wrote:

> Hi,
>
> On Thu, Mar 07, 2024 at 09:44:51AM +0100, Hans wrote:
> > --- sninp ---
> > 
> > Authentication-Results: mail35c50.megamailservers.eu; spf=none 
> > smtp.mailfrom=lists.debian.org
> > Authentication-Results: mail35c50.megamailservers.eu;
> > 	dkim=fail reason="signature verification failed" (2048-bit key) 
> > header.d=debian.org header.i=@debian.org header.b="pDp/TPD5"
> > Return-Path: <bounce-debian-devel=hans.ullrich=loop.de@lists.debian.org>
> > Received: from bendel.debian.org (bendel.debian.org [82.195.75.100])
> > 	by mail35c50.megamailservers.eu (8.14.9/8.13.1) with ESMTP id 
> > 425I9ZEK112497
> > 	for <hans.ullrich@loop.de>; Tue, 5 Mar 2024 18:09:37 +0000
> > 
> > --- snap ---
> > 
> > White mails get the dkim=pass and spam mails got dkim=fail (as you see above).
>
> A great many legitimate emails will fail DKIM so it is not a great
> idea to reject every email that does so. I don't think that you are
> going to have a good time using Internet mailing lists while your
> mail provider rejects mails with invalid DKIM, so if I were you I'd
> work on fixing that rather than trying to get everyone involved to
> correctly use DKIM.

And some dkim seems setup with the intention that it should not be used
for mailinglusts:

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=dow.land;
    s=20210720;
h=From:In-Reply-To:References:Subject:To:Message-Id:Date:
    Content-Type:Content-Transfer-Encoding:Mime-Version:Sender:Reply-To:Cc:
    Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:
    Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:
    List-Subscribe:List-Post:List-Owner:List-Archive;

This one passed on bendel but not when it got to me. Most on debian-user
seem ok, debian-devel does seem to get more submissions with broken dkim
(based on looking at a random handful on each list)

AFAICT, it's a problem at the originator causing failures, either
something wrong with dkim setup or too strict set of headers.

I shall be checking what this does when it gets back to me. One of the
problems with dkim is that you assume it still works, it's hard to know
what others actually see...