Re: [mailop] dkim signature failures sendmail/opendkim

2017-06-12 Thread Brandon Long via mailop
It's unfortunate that dkim canonicalization is based on the raw message, and now on what the message represents, though defining a shared understanding of the "decoded" message along various lines would be quite complicated (IMAP somewhat does that, I guess). In any case, obviously if you care

Re: [mailop] dkim signature failures sendmail/opendkim

2017-06-11 Thread Carl Byington
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Fri, 2017-05-26 at 18:38 +0300, Vladimir Dubrovin wrote: > In most cases, DKIM check fails because message was improperly > formatted and was normalized by MTA before sending after DKIM > signature is applied. We changed the mail flow so the

Re: [mailop] dkim signature failures sendmail/opendkim

2017-05-27 Thread Lilium
Using sendmail with opendkim for signing mostly works, but I have a few domains with dmarc p=reject, and looking at the aggregate reports, I am seeing some dkim=fail, spf=pass on a small amount of mail going to google, comcast, etc. The aggregate reports show that mail is signed with the right

Re: [mailop] dkim signature failures sendmail/opendkim

2017-05-26 Thread Carl Byington
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Fri, 2017-05-26 at 17:09 -0400, valdis.kletni...@vt.edu wrote: > How many of the user agents are running on non-servers that don't have > NTP? Does that matter? The dkim signature (with t=) is generated on the mail server, which has the proper

Re: [mailop] dkim signature failures sendmail/opendkim

2017-05-26 Thread Carl Byington
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Fri, 2017-05-26 at 18:38 +0300, Vladimir Dubrovin via mailop wrote: > - Lines longer than 998 octets (unicode character takes few octets) > - Missed Date:, Message-ID: or another required header > - Unencoded 8-bit character in the header > -

Re: [mailop] dkim signature failures sendmail/opendkim

2017-05-26 Thread Jim Ohlstein
On Fri, 2017-05-26 at 17:13 +0100, Ken O'Driscoll wrote: > I encountered something similar. Running sendmail/opendkim for > outbound > mail and saw intermittent DKIM failures. > > On further investigation, I have narrowed my failures down to sending > from > my main MUA, Evolution. All my testing

Re: [mailop] dkim signature failures sendmail/opendkim

2017-05-26 Thread Brandon Long via mailop
>From our records, most of the errors are "Verify failed", which implies a header mismatch (there are also a few body hash mismatch, which would be a body issue instead). On Fri, May 26, 2017 at 9:55 AM, John Levine wrote: > In article

Re: [mailop] dkim signature failures sendmail/opendkim

2017-05-26 Thread John Levine
In article <1495815209.2586.28.ca...@wemonitoremail.com> you write: >Any suggestions would be very welcome as long they don't involve swapping >out sendmail or Evolution! Put a shim between Evolution and sendmail so you can see what it's sending, and how sendmail rewrote it. From what you said,

Re: [mailop] dkim signature failures sendmail/opendkim

2017-05-26 Thread Ken O'Driscoll
I encountered something similar. Running sendmail/opendkim for outbound mail and saw intermittent DKIM failures. On further investigation, I have narrowed my failures down to sending from my main MUA, Evolution. All my testing showed that other MUAs, including the Gmail mobile client, the

Re: [mailop] dkim signature failures sendmail/opendkim

2017-05-26 Thread Vladimir Dubrovin via mailop
In most cases, DKIM check fails because message was improperly formatted and was normalized by MTA before sending after DKIM signature is applied. This usually means: - Lines longer than 998 octets (unicode character takes few octets) - Missed Date:, Message-ID: or another required header -

Re: [mailop] dkim signature failures sendmail/opendkim

2017-05-26 Thread Steve Atkins
> On May 26, 2017, at 8:00 AM, Carl Byington wrote: > > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA512 > > Using sendmail with opendkim for signing mostly works, but I have a few > domains with dmarc p=reject, and looking at the aggregate reports, I am > seeing some

Re: [mailop] dkim signature failures sendmail/opendkim

2017-05-26 Thread Vick Khera
On Fri, May 26, 2017 at 11:00 AM, Carl Byington wrote: > Any ideas for debugging this? > Do your messages have non-ascii in them? If so, be sure to QP encode them, otherwise some intermediate transit relays may muck up the signatures by rewriting them.

[mailop] dkim signature failures sendmail/opendkim

2017-05-26 Thread Carl Byington
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Using sendmail with opendkim for signing mostly works, but I have a few domains with dmarc p=reject, and looking at the aggregate reports, I am seeing some dkim=fail, spf=pass on a small amount of mail going to google, comcast, etc. The aggregate