Yahoo!, DKIM, and Content-Length

2014-10-06 Thread Ricardo Signes
I've seen a number of messages about Yahoo! and DMARC failures, but none seem to touch on what I think is the big problem right now. If I missed this happening, I apologize. For some completely inexplicable reason, their DKIM signatures now (often, but not always) look like this:

Re: Yahoo!, DKIM, and Content-Length

2014-10-06 Thread Ricardo Signes
* Robert Schetterer r...@sys4.de [2014-10-06T12:49:09] involving Content-Length is then broken. hm where in http://www.postfix.org/cleanup.8.html is a delete action documented ? It's documented in the release notes for v1.1. It's mentioned that cleanup(8) does this in the man page for

Re: PATCH: Yahoo!, DKIM, and Content-Length

2014-10-06 Thread Ricardo Signes
* Wietse Venema wie...@porcupine.org [2014-10-06T13:22:04] Good catch. Unfortunately, this behavior is not configurable. Changing Postfix behavior requires either patching one bit in the executable file, or rebuilding Postfix from source. Thanks for confirming my suspicion. By now, maybe is

Re: Yahoo!, DKIM, and Content-Length

2014-10-06 Thread Ricardo Signes
* Viktor Dukhovni postfix-us...@dukhovni.org [2014-10-06T13:40:52] It is also odd that they sign Received headers, I thought BCP was to avoid doing that: Yes, you are correct. The RFC goes on to show examples that use Received, and various strictures about handling trace headers make it

more detail on lookup failures?

2014-09-04 Thread Ricardo Signes
Lately, I'm seeing a lot more of this from some servers: postfix/cleanup[20330]: [ID 947731 mail.warning] warning: mysql:/etc/postfix/mysql_list_resend.cf lookup error for [...] postfix/cleanup[20330]: [ID 947731 mail.warning] warning: 6D0D222182: virtual_alias_maps map lookup

Re: more detail on lookup failures?

2014-09-04 Thread Ricardo Signes
* Wietse Venema wie...@porcupine.org [2014-09-04T15:55:07] Wietse Venema: If there is no logfile record with: warning: mysql query failed: [text from mysql_error() here] then either your syslog daemon lost that record, Yes. Thanks. I'll look harder, but this has happened

Re: more detail on lookup failures?

2014-09-04 Thread Ricardo Signes
* Wietse Venema wie...@porcupine.org [2014-09-04T15:55:07] No. All match_list errors are logged with the match_error() function. First, let me note that I'm running 2.10.2. Here are all the syslog entries for cleanup for the last half hour on one host that's been having this problem. tl;dr: 32

using/logging client addr as part of SASL auth

2014-05-27 Thread Ricardo Signes
Hello! I'm looking for a way to detect and distinguish different kinds of auth failures. Right now, I'm feeling a bit stuck by my inability to get all the data I'd like in one place at the same time. Right now, we're using SASL authentication with pwcheck. pwcheck, of course, only gets two

Re: using/logging client addr as part of SASL auth

2014-05-27 Thread Ricardo Signes
* Wietse Venema wie...@porcupine.org [2014-05-27T17:04:32] li...@rhsoft.net: the problem ist that postfix has no idea of the SASL internals and should not need to - in case of dovecot i asked a few days ago to log the username because in case of using dovecot as SASL provider that's the

Re: using/logging client addr as part of SASL auth

2014-05-27 Thread Ricardo Signes
* Wietse Venema wie...@porcupine.org [2014-05-27T17:48:03] Ricardo Signes: a. one IP, the same username, many different passwords d. one IP, the same username, the same (wrong) password repeatedly I suppose that one would log a password hhas, just to be sure. Yes, something like

ignoring bogux MX entries

2011-06-20 Thread Ricardo Signes
So, every once in a while, this crops up: $ dig -t mx bollygroup.com ; DiG 9.4.2-P1 -t mx bollygroup.com ;; global options: printcmd ;; Got answer: ;; -HEADER- opcode: QUERY, status: NOERROR, id: 996 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0 ;;

per-user usage metering

2011-06-08 Thread Ricardo Signes
Hi, Postfix. Long-time fan, first time poster. I need to keep track of per-user use of our SASL-authenticated outbound relay, and to reject mail from users who are exceeding their allowed usage. The records of their usage need to be accessible to me elsewhere over extended durations, although