Alessandro Vesely writes: > On Tue 13/Jun/2023 23:33:50 +0200 Tero Kivinen wrote: > > [...] > > > > As you can see 85.75% of incoming email was already signed by DKIM, > > and 86.5% of emails had SPF records that passed. So they both have > > about same amount if usage coming in to our servers. > > > What are those 0.75%, some 30k SPF - DKIM messages? Are there cases of DKIM > random failure salvaged by SPF?
My current analysis script does not try to calculate that, I would need to need to add that step there and rerun the script. If I understand correctly you would like to see cases where if there is both SPF and DKIM, the cases where the both, only one, or neither passed, and how many of those cases would be where dkim=fail, but spf=pass? I will try to see if I can run the that check later. > > 0.19% 7506 none,pass > > 0.15% 5910 pass,none > > How do you order DKIM signatures? My understanding is that rspamd most likely uses the order of DKIM signatures in the email body. On the other hand order does not matter, as if ANY of the dkim checks pass, then the whole message passes. The reason I printed out the combinations of different dkim results was to show that there are cases where there is multiple dkim headers and some of those pass and some fail. I.e there were: 0.00% 4 pass,fail,fail,fail,fail 0.00% 2 pass,pass,pass,pass,pass,pass I.e. four emails had five dkim records, four of them failing and one passing, where another two one had six dkim records all passing. Most of the emails had oly one dkim record, and those of which had two most of them were so that both passed. -- kivi...@iki.fi _______________________________________________ dmarc mailing list dmarc@ietf.org https://www.ietf.org/mailman/listinfo/dmarc
