Mailing List Archive: exim: users

[Exim-Users] Problem setting up exim 4.80.1 with Domain Keys signing

Index | Next | Previous | View Threaded

avladulescu at hosthub

Jul 23, 2013, 6:56 PM

Post #1 of 4 (70 views)
Permalink

[Exim-Users] Problem setting up exim 4.80.1 with Domain Keys signing

Dear all,

After days and hours of google-ing over the internet I could come up
with a solution to my problem (I have even checked you github FAQ),
therefore I am writing you all this email. I have setup up exim 4.80.1,
and I am having a very hard time trying to identify why email leaving my
server don't have the DomainKeys signature on the their headers.

I have to mention that I have DKIM working on my installation through,
and all emails going out are DKIM signed.

Now, I know that DomainKeys are deprecated and probably will be replaced
with DKIM, but still we have mail service providers like Yahoo, that
still decide to look-up over the Domain Keys for email headers
signature. The result is that my emails to them are getting marked as SPAM.

Below it's my configured settings for DKIM

remote_smtp:
driver = smtp
dkim_domain = domain.org
dkim_selector = mail
dkim_private_key = /etc/dkim/keys/domain.org/mail.private
dkim_canon = simple
dkim_strict = 1
dkim_sign_headers =
Content-Type:To:From:Subject:Sender:Reply-To:Cc:MIME-Version

I would like also to mention that I have been searching the web for an
dkim_sign_headers example and got just few self-explanatory cases that I
could match and show on how this setting should be setup in the first
place. Most of the topics covering this subject are just referring to
the dkim_sign_headers as a possible variable setup.

I need to mention also that I have tried recompiling exim many times,
even setting EXPERIMENTAL_DOMAINKEYS=yes (although I understood is
deprecated since 4.69) or WITH_DOMAINKEYS=yes but without a luck or
setting the daemon run in full debug mode. I had also reference to this
link, but with no joy: https://github.com/Exim/exim/wiki/DomainKeys

Paste from the page:

/The 4.69 release of Exim contained experimental support for DomainKeys.
In the 4.70 release, this was replaced with non-experimental DKIM
support. This documentation is left as a reference for those using
systems still based around 4.69./

I don't know if 4.80.1 is still called based around 4.69 :). Somebody
else on the internet mentioned that changing relaxed (which I had
initially configured on dkim_canon) to simple might do the trick, but
with no luck for me.

Testing out the service (at check-auth [at] verifier) after each
command/setting change still results me in:

/==========================================================
Summary of Results
==========================================================
SPF check: pass
DomainKeys check: neutral
DKIM check: pass
Sender-ID check: pass
SpamAssassin check: ham/

I would like to request you kindly help on the current matter, as I am getting chump in considering how hard is to implement this in exim tho in comparison with postfix's opendkim.

Thank you all.

Regards,
Alex Vladulescu

--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

Lena at lena

Jul 24, 2013, 7:20 AM

Post #2 of 4 (66 views)
Permalink

Re: [Exim-Users] Problem setting up exim 4.80.1 with Domain Keys signing [In reply to]

> From: Alexandru Vladulescu <avladulescu [at] hosthub>

> we have mail service providers like Yahoo, that
> still decide to look-up over the Domain Keys for email headers
> signature.

yahoo looks for either DomainKeys or DKIM.

> The result is that my emails to them are getting marked as SPAM.

Not because you sign with DKIM without DomainKeys.
Sign up for http://feedbackloop.yahoo.net
http://help.yahoo.com/kb/index?locale=en_US&page=content&id=SLN3438

> SPF check: pass
> DomainKeys check: neutral
> DKIM check: pass

That's enough signing.

> SpamAssassin check: ham/

If your yahooMail recipients click "this is spam" then yahoo believes
that it is spam.
If your yahooMail recipient reads your message in Spam folder and then
deletes the message then you'll get feedback loop message and yahoo will
consider that as the user's confirmation that the message was spam -
stupid, but that's yahoo for you.

I blacklist entire blocks of IP-addresses in Romania at first spam.

--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

abr28 at cam

Jul 24, 2013, 8:00 AM

Post #3 of 4 (67 views)
Permalink

Re: [Exim-Users] Problem setting up exim 4.80.1 with Domain Keys signing [In reply to]

avladulescu at hosthub

Jul 30, 2013, 7:35 AM

Post #4 of 4 (39 views)
Permalink

Re: [Exim-Users] Problem setting up exim 4.80.1 with Domain Keys signing [In reply to]

The most spam-related issues with my legit outgoing email I had were
with Yahoo ...

IIRC from my tests which drove me insane, Yahoo seemed to check if the
From header has matching words as the From envelope (note that these
two are not one and the same) and also does similar check on the
Return-Path header. It was extremely hard to send email on-behalf-of
style. Adding Reply-To was making it worse IIRC. They also don't explain
the checks they are doing and it's close to impossible to reach them to
inquire about this in order to adjust your setup.

I just gave up on Yahoo in the end. Not that I adore Google, but I had
far less trouble with Gmail.

Exim does not directly support DomainKeys (it does DKIM) but Yahoo
checks both. There seems to be nothing wrong with your DKIM setup.

@Lena: Blacklisting entire IP blocks at first spam is a bit harsh ... or
maybe Romania has a special place in your heart.

Alex.

On 24 Jul 13 3:20 pm, Lena [at] lena wrote:
>> From: Alexandru Vladulescu <avladulescu [at] hosthub>
>
>> we have mail service providers like Yahoo, that
>> still decide to look-up over the Domain Keys for email headers
>> signature.
>
> yahoo looks for either DomainKeys or DKIM.
>
>> The result is that my emails to them are getting marked as SPAM.
>
> Not because you sign with DKIM without DomainKeys.
> Sign up for http://feedbackloop.yahoo.net
> http://help.yahoo.com/kb/index?locale=en_US&page=content&id=SLN3438
>
>> SPF check: pass
>> DomainKeys check: neutral
>> DKIM check: pass
>
> That's enough signing.
>
>> SpamAssassin check: ham/
>
> If your yahooMail recipients click "this is spam" then yahoo believes
> that it is spam.
> If your yahooMail recipient reads your message in Spam folder and then
> deletes the message then you'll get feedback loop message and yahoo will
> consider that as the user's confirmation that the message was spam -
> stupid, but that's yahoo for you.
>
> I blacklist entire blocks of IP-addresses in Romania at first spam.
>

--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

Interesting feedback !

Still, how to make exim sign both DKIM and DomainKeys while it can
increase the delivery score ? I know it's possible with postfix,
although I love both.

Another trick that I consider doing in this case is to setup a 25 port
postfix (buffer-localhost-relay; dummy forward only from outside to
inside and inside to outside, but not open relay ) that could handle the
signing of both.

The scenario I will setup for test is the following:

* Port 25 Internet <----> Postfix (relay buffer & singing practices
through opendkim milter ) <---> <Some other port, eg localhost:2525
> Delivery to Main Exim Framework
* For remote user accounting, we can still use the 465, 587 going
directly to Exim Framework.

Going to get back to you after the integration of the upper scheme.

Thanks,
Alex V

--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads