Re: [mailop] Only Earthlink failing DKIM, any contacts here?

[Vladimir Dubrovin via mailop]

It's weird to block messages on DKIM verification, I see no reason to do
so, but usually there is a reason why DKIM signature breaks. Most common
issue is malformed message is being normalized prior to DKIM check. You
should verify in first place:
1. There is no 8-bit characters in headers
2. There is no oversized lines (>998 octets) in body
3. Message-ID: and Date: headers are generated
4. From: header matches the standard
5. CRLF line breaks are used (or relaxed canonization is used for DKIM)
6. Tracing headers (like Return-Path: or Received:) are not signed


08.01.2018 18:58, Albert Liu пишет:
> Hi There,
>
> Apologies -- forgot to edit the SL in my initial message.
>
> Does anyone have a contact at Earthlink.net? 
>
> We started seeing DKIM fail for our clients only at Earthlink.net
> about 2 months ago (no issues with any other major ISPs) and now some
> mail is being hard blocked with "551 ERROR: DKIM signature
> verification failed (signature verification failed)".
>
> Thank you!
> Albert
>
> On Mon, Jan 8, 2018 at 7:52 AM,  > wrote:
>
> Send mailop mailing list submissions to
>         mailop@mailop.org 
>
> To subscribe or unsubscribe via the World Wide Web, visit
>        
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
> 
> or, via email, send a message with subject or body 'help' to
>         mailop-requ...@mailop.org 
>
> You can reach the person managing the list at
>         mailop-ow...@mailop.org 
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of mailop digest..."
>
>
> Today's Topics:
>
>    1. Re: Anyone with a pulse at combell.com ?
> (Philip Paeps)
>    2. Re: Anyone with a pulse at combell.com ?
> (Ken O'Driscoll)
>    3. Re: Anyone with a pulse at combell.com ?
> (Charles McKean)
>    4. Re: Weird problems with mitigation at Hotmail/Outlook
>       (John Possidente)
>    5. Re: mailop Digest, Vol 123, Issue 8 (Albert Liu)
>
>
> --
>
> Message: 1
> Date: Mon, 8 Jan 2018 13:15:25 +0100
> From: Philip Paeps >
> To: mailop@mailop.org 
> Subject: Re: [mailop] Anyone with a pulse at combell.com
> ?
> Message-ID: <20180108121524.gp89...@rincewind.trouble.is
> >
> Content-Type: text/plain; charset=us-ascii; format=flowed
>
> On 2018-01-08 09:44:10 (+0100), David Hofstee wrote:
> >On 6 January 2018 at 15:32, Philip Paeps  > wrote:
> >>I'm getting repeated spamtrap hits from customers of combell.com
> .
> >>Forwarding messages (even just headers) to abuse@ gets bounces:
> >>
> >>  ab...@combell.com 
> >>    host 217.21.178.56  [217.21.178.56
> ]
> >>    SMTP error from remote mail server after end of data:
> >>    550 5.7.1 Message rejected as spam by Content Filtering.
> >>
> >>Asking abuse@ how they'd like to be told about their customers'
> >>network abuse gets bounced with the same error.  Great!
> >>
> >>Does anyone know any humans there?
> >>
> >> They're unfortunately too large to block outright.
> >
> >Did you try it with a non-"trouble.is " domain?
>
> Yes.  I sent these from postmaster@ the several domains where the
> spamtraps are hosted and from philip@ in the domains I've got
> mailboxes
> in.  Always the same error: "Message rejected as spam by Content
> Filtering".
>
> >E.g. an @gmail.com  account?
>
> I don't have one of those.
>
> It doesn't look like the return address matters though.
>
> Aside: it seems more than a bit silly to run a content filter on
> abuse@.
> If their filter feeds into reputation monitoring systems, I've
> probably
> damaged my networks' reputations by being a good internet citizen and
> reporting abuse of their network!
>
> Philip
>
> --
> Philip Paeps
> Senior Reality Engineer
> Ministry of Information
>
>
>
> --
>
> Message: 2
> Date: Mon, 08 Jan 2018 13:18:23 +
> From: Ken O'Driscoll  >
> To: mailop@mailop.org 
> Subject: Re: [mailop] Anyone with a pulse at combell.com
> ?
> Message-ID: 

Re: [mailop] Only Earthlink failing DKIM, any contacts here?

[Albert Liu]

Hi There,

Apologies -- forgot to edit the SL in my initial message.

Does anyone have a contact at Earthlink.net?

We started seeing DKIM fail for our clients only at Earthlink.net about 2
months ago (no issues with any other major ISPs) and now some mail is being
hard blocked with "551 ERROR: DKIM signature verification failed (signature
verification failed)".

Thank you!
Albert

On Mon, Jan 8, 2018 at 7:52 AM,  wrote:

> Send mailop mailing list submissions to
> mailop@mailop.org
>
> To subscribe or unsubscribe via the World Wide Web, visit
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
> or, via email, send a message with subject or body 'help' to
> mailop-requ...@mailop.org
>
> You can reach the person managing the list at
> mailop-ow...@mailop.org
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of mailop digest..."
>
>
> Today's Topics:
>
>1. Re: Anyone with a pulse at combell.com? (Philip Paeps)
>2. Re: Anyone with a pulse at combell.com? (Ken O'Driscoll)
>3. Re: Anyone with a pulse at combell.com? (Charles McKean)
>4. Re: Weird problems with mitigation at Hotmail/Outlook
>   (John Possidente)
>5. Re: mailop Digest, Vol 123, Issue 8 (Albert Liu)
>
>
> --
>
> Message: 1
> Date: Mon, 8 Jan 2018 13:15:25 +0100
> From: Philip Paeps 
> To: mailop@mailop.org
> Subject: Re: [mailop] Anyone with a pulse at combell.com?
> Message-ID: <20180108121524.gp89...@rincewind.trouble.is>
> Content-Type: text/plain; charset=us-ascii; format=flowed
>
> On 2018-01-08 09:44:10 (+0100), David Hofstee wrote:
> >On 6 January 2018 at 15:32, Philip Paeps  wrote:
> >>I'm getting repeated spamtrap hits from customers of combell.com.
> >>Forwarding messages (even just headers) to abuse@ gets bounces:
> >>
> >>  ab...@combell.com
> >>host 217.21.178.56 [217.21.178.56]
> >>SMTP error from remote mail server after end of data:
> >>550 5.7.1 Message rejected as spam by Content Filtering.
> >>
> >>Asking abuse@ how they'd like to be told about their customers'
> >>network abuse gets bounced with the same error.  Great!
> >>
> >>Does anyone know any humans there?
> >>
> >> They're unfortunately too large to block outright.
> >
> >Did you try it with a non-"trouble.is" domain?
>
> Yes.  I sent these from postmaster@ the several domains where the
> spamtraps are hosted and from philip@ in the domains I've got mailboxes
> in.  Always the same error: "Message rejected as spam by Content
> Filtering".
>
> >E.g. an @gmail.com account?
>
> I don't have one of those.
>
> It doesn't look like the return address matters though.
>
> Aside: it seems more than a bit silly to run a content filter on abuse@.
> If their filter feeds into reputation monitoring systems, I've probably
> damaged my networks' reputations by being a good internet citizen and
> reporting abuse of their network!
>
> Philip
>
> --
> Philip Paeps
> Senior Reality Engineer
> Ministry of Information
>
>
>
> --
>
> Message: 2
> Date: Mon, 08 Jan 2018 13:18:23 +
> From: Ken O'Driscoll 
> To: mailop@mailop.org
> Subject: Re: [mailop] Anyone with a pulse at combell.com?
> Message-ID: <1515417503.3115.2.ca...@wemonitoremail.com>
> Content-Type: text/plain; charset="UTF-8"
>
> On Mon, 2018-01-08 at 13:15 +0100, Philip Paeps wrote:
> > Aside: it seems more than a bit silly to run a content filter on
> > abuse@.
> > If their filter feeds into reputation monitoring systems, I've probably
> > damaged my networks' reputations by being a good internet citizen and
> > reporting abuse of their network!
>
> The RFC explicitly advises against that but people still do it.
>
> Their "email support" option appears to be a pop-up form which may allow
> you to circumvent any pre-acceptance testing:
>
> https://www.combell.com/en/support
>
> Ken.
>
> --
> Ken O'Driscoll / We Monitor Email
> t: +353 1 254 9400 | w: www.wemonitoremail.com
>
> Need to understand deliverability? Now there's a book:
> www.wemonitoremail.com/book
>
>
>
>
> --
>
> Message: 3
> Date: Mon, 8 Jan 2018 09:36:07 -0500
> From: Charles McKean 
> To: mailop 
> Subject: Re: [mailop] Anyone with a pulse at combell.com?
> Message-ID:
>