1

Topic: Mailing Lists and original poster DKIM issues

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 2024030401 (Backend: mariadb, Date: 2024-04-08 12:13:19)
- Deployed with iRedMail Easy
- Linux/BSD distribution name and version: Debian 10
- Store mail accounts in which backend: MySQL
- Web server: Nginx
- Manage mail accounts with iRedAdmin-Pro? Yes
====

We have a few mailing lists hosted on our mail server.  With Google and Yahoo basically enforcing everyone to use SPF, DKIM and DMARC our clients have now implemented this (This is a good thing overall, just introduces new issues).

I've been trying to track down why some clients were going too Spam (Google) or not delivered at all (mac.com). But others had no issues.

After investigation I've found out that it depends on the DMARC policy of none, quarantine or reject.

The client whose emails were either going to Google's spam or not delivered at all (mac.com) had their policy to 'reject'.

I found this posting: https://begriffs.com/posts/2018-09-18-d … -list.html

I've modified:  /opt/iredmail/custom/mlmmjadmin/settings.py
--------
MLMMJ_DEFAULT_REMOVED_HEADERS = [
    'Authentication-Results:',
    'ARC-Authentication-Results:',
    'DKIM-Signature:'
]
--------
Then restarted the mlmmjadmin service. (and eventually the whole server).


Questions:
1) Why is the mac.com one passing but the two clients using google failing ?
2) Can I moved the source dkim, etc. headers so that only my dkim header is passed onto the receiver ?


For now - the client has changed their policy to none also and their messages are being received - but this seems like something that a mailing list should be able to do ?

thanks
Kent.


======
Looking at the source headers for the dkim/spf/dmarc authentication (these are from my test gmail account).

Sender: via google, dmarac policy = reject
------------------------------------------------------
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@kamar.nz header.s=dkim header.b="Pwjw6jF/";
dkim=fail header.i=@obhs.school.nz header.s=google header.b=T8ewpJO+;
spf=pass (google.com: domain of betas+bounces-...@kamar.nz designates 2001:df5:5e80::251 as permitted sender) smtp.mailfrom="betas+bounces-...@kamar.nz";
dmarc=fail (p=REJECT sp=REJECT dis=QUARANTINE) header.from=obhs.school.nz


Sendar: via google, dmarc policy = none
------------------------------------------------------
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@kamar.nz header.s=dkim header.b=rEVBGEAt;
dkim=fail header.i=@gc.ac.nz header.s=google header.b=hULp+8fg;
spf=pass (google.com: domain of betas+bounces-...@kamar.nz designates 103.158.176.251 as permitted sender) smtp.mailfrom="betas+bounces-...@kamar.nz";
dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=gc.ac.nz


Sendar: via mac.com, dmarc policy = none
--------------------------------------------------------
Authentication-Results: mx.google.com;
dkim=pass header.i=@kamar.nz header.s=dkim header.b=PkEba7EG;
dkim=pass header.i=@mac.com header.s=1a1hai header.b=dxSFCrB5;
spf=pass (google.com: domain of betas+bounces-...@kamar.nz designates 103.158.176.251 as permitted sender) smtp.mailfrom="betas+bounces-...@kamar.nz";
dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=mac.com

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: Mailing Lists and original poster DKIM issues

1) Why is the mac.com one passing but the two clients using google failing ?
I worked this out.  The mac.com doesn't include 'reply-to' in it's dkim checks, but google is. This is why the mac.com passed and Google didn't.



2) Can I remove the source dkim, etc. headers so that only my dkim header is passed onto the receiver ?

I can't work this out. If notes in the default_settings.py file indicate this is how you remove the headers, but doesn't appear to be working  (I've even tried modify the default_settings.py file)


Ideas ?

Kent.

3

Re: Mailing Lists and original poster DKIM issues

Okay, I've done more testing and have set up a google group to see what Google does.

1) They remove the original dkim and authentication from the message.

2) They change the from to be:  "'Poster Name' via List Name" <listname@domain.com>

3) They add headers:
X-Original-Sender: <senders@email.address>
X-Original-Authentication-Results:
X-Original-From: Senders Name <senders@email.address>


This means it looks like the email is from Google, regardless who sent it in the first place. And the only DKIM in the headers is Googles - so always passes the SPF/DKIM/DMARC checks.

Can this be achieved using mlmmj ?

Thanks
Kent.

4

Re: Mailing Lists and original poster DKIM issues

I've made some progress, so posting here for the benefit of others including myself in a years time.  (and also incase I've done it completely wrong).

The only thing is it completely replaces 'From:' with the lisstname.  I'd like it to be "Original Name via List Name" <listname@domain.nz>

I've based these changes on:  http://mlmmj.org/docs/tunables/


cd /var/vmail/mlmmj/ <domain> / <listname / control /

1) Edit file: customheaders
-----------
Precedence: bulk
From: List Name <listname@domain.nz>
X-Mailing-List: listname@domain.nz
List-Id: <listname@domain.nz>
List-Post: <mailto:listname@domain.nz>
List-Subscribe: <mailto: listname+subscribe@domain.nz?subject=Subscribe>
List-Unsubscribe: <mailto: listname+unsubscribe@domain.nz?subject=Unsubscribe>
--------

2) Edit File: delheaders
------------
From:
DKIM-Signature:
X-Google-DKIM-Signature:
X-Gm-Message-State:
X-Google-Smtp-Source:
Authentication-Results:
ARC-Seal:
ARC-Message-Signature:
ARC-Authentication-Results:
--------------

Note: The documentation says 'From:' isn't needed as it's automatically removed, but I'd added before I read that and it doesn't seem to do any harm so I've left there.


No need to restart anything - changes apply for next email.

5

Re: Mailing Lists and original poster DKIM issues

I see you posted in mlmmj mailing list too, let's wait for mlmmj developers' sharing.

6

Re: Mailing Lists and original poster DKIM issues

ZhangHuangbin wrote:

I see you posted in mlmmj mailing list too, let's wait for mlmmj developers' sharing.

Have any updates?