Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: SpamAssassin: users

T_DKIM_INVALID for gmail ??

 

 

SpamAssassin users RSS feed   Index | Next | Previous | View Threaded


ryann.braganza at gmail

Jul 18, 2013, 3:31 AM

Post #1 of 11 (165 views)
Permalink
T_DKIM_INVALID for gmail ??

Why is T_DKIM_INVALID getting triggered for gmail ? I have seen this
happening many times with my servers, the dkim gets passed , then why does
this invalid rule hit? Any inputs? am using SpamAssassin version 3.3.2


uhlar at fantomas

Jul 18, 2013, 3:33 AM

Post #2 of 11 (162 views)
Permalink
Re: T_DKIM_INVALID for gmail ?? [In reply to]

On 18.07.13 16:01, Ryan Braganza wrote:
>Why is T_DKIM_INVALID getting triggered for gmail ? I have seen this
>happening many times with my servers, the dkim gets passed , then why does
>this invalid rule hit? Any inputs? am using SpamAssassin version 3.3.2

are you getting those mails from gmail directly, without forwarding by
anyone?
--
Matus UHLAR - fantomas, uhlar [at] fantomas ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Depression is merely anger without enthusiasm.


ryann.braganza at gmail

Jul 18, 2013, 3:35 AM

Post #3 of 11 (162 views)
Permalink
Re: T_DKIM_INVALID for gmail ?? [In reply to]

Hi thanks for the reply, these mails 1st come to an MX server and from
there to the spamasasin server.


On Thu, Jul 18, 2013 at 4:03 PM, Matus UHLAR - fantomas
<uhlar [at] fantomas>wrote:

> On 18.07.13 16:01, Ryan Braganza wrote:
>
>> Why is T_DKIM_INVALID getting triggered for gmail ? I have seen this
>> happening many times with my servers, the dkim gets passed , then why does
>> this invalid rule hit? Any inputs? am using SpamAssassin version 3.3.2
>>
>
> are you getting those mails from gmail directly, without forwarding by
> anyone?
> --
> Matus UHLAR - fantomas, uhlar [at] fantomas ; http://www.fantomas.sk/
> Warning: I wish NOT to receive e-mail advertising to this address.
> Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
> Depression is merely anger without enthusiasm.


uhlar at fantomas

Jul 18, 2013, 3:47 AM

Post #4 of 11 (163 views)
Permalink
Re: T_DKIM_INVALID for gmail ?? [In reply to]

>> On 18.07.13 16:01, Ryan Braganza wrote:
>>> Why is T_DKIM_INVALID getting triggered for gmail ? I have seen this
>>> happening many times with my servers, the dkim gets passed , then why does
>>> this invalid rule hit? Any inputs? am using SpamAssassin version 3.3.2

>On Thu, Jul 18, 2013 at 4:03 PM, Matus UHLAR - fantomas
><uhlar [at] fantomas>wrote:
>> are you getting those mails from gmail directly, without forwarding by
>> anyone?

On 18.07.13 16:05, Ryan Braganza wrote:
>Hi thanks for the reply, these mails 1st come to an MX server and from
>there to the spamasasin server.

isn't the server by any change running courier MTA?
some versions used to reformat some of mime headers which results in DKIM
getting invalid

(as far as I see it, that seems to be a design flaw of DKIM)

--
Matus UHLAR - fantomas, uhlar [at] fantomas ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Eagles may soar, but weasels don't get sucked into jet engines.


ryann.braganza at gmail

Jul 18, 2013, 3:51 AM

Post #5 of 11 (163 views)
Permalink
Re: T_DKIM_INVALID for gmail ?? [In reply to]

On Thu, Jul 18, 2013 at 4:17 PM, Matus UHLAR - fantomas
<uhlar [at] fantomas>wrote:

> On 18.07.13 16:01, Ryan Braganza wrote:
>>>
>>>> Why is T_DKIM_INVALID getting triggered for gmail ? I have seen this
>>>> happening many times with my servers, the dkim gets passed , then why
>>>> does
>>>> this invalid rule hit? Any inputs? am using SpamAssassin version 3.3.2
>>>>
>>>
> On Thu, Jul 18, 2013 at 4:03 PM, Matus UHLAR - fantomas
>> <uhlar [at] fantomas>wrote:
>>
>>> are you getting those mails from gmail directly, without forwarding by
>>> anyone?
>>>
>>
> On 18.07.13 16:05, Ryan Braganza wrote:
>
>> Hi thanks for the reply, these mails 1st come to an MX server and from
>> there to the spamasasin server.
>>
>
> isn't the server by any change running courier MTA?
> some versions used to reformat some of mime headers which results in DKIM
> getting invalid
>
> (as far as I see it, that seems to be a design flaw of DKIM)


No we dont have courier MTA, its just postfix


>
>
> --
> Matus UHLAR - fantomas, uhlar [at] fantomas ; http://www.fantomas.sk/
> Warning: I wish NOT to receive e-mail advertising to this address.
> Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
> Eagles may soar, but weasels don't get sucked into jet engines.


uhlar at fantomas

Jul 18, 2013, 3:55 AM

Post #6 of 11 (162 views)
Permalink
Re: T_DKIM_INVALID for gmail ?? [In reply to]

On 18.07.13 16:21, Ryan Braganza wrote:
>On Thu, Jul 18, 2013 at 4:17 PM, Matus UHLAR - fantomas
><uhlar [at] fantomas>wrote:
>
>> On 18.07.13 16:01, Ryan Braganza wrote:
>>>>
>>>>> Why is T_DKIM_INVALID getting triggered for gmail ? I have seen this
>>>>> happening many times with my servers, the dkim gets passed , then why
>>>>> does
>>>>> this invalid rule hit? Any inputs? am using SpamAssassin version 3.3.2
>>>>>
>>>>
>> On Thu, Jul 18, 2013 at 4:03 PM, Matus UHLAR - fantomas
>>> <uhlar [at] fantomas>wrote:
>>>
>>>> are you getting those mails from gmail directly, without forwarding by
>>>> anyone?
>>>>
>>>
>> On 18.07.13 16:05, Ryan Braganza wrote:
>>
>>> Hi thanks for the reply, these mails 1st come to an MX server and from
>>> there to the spamasasin server.
>>>
>>
>> isn't the server by any change running courier MTA?
>> some versions used to reformat some of mime headers which results in DKIM
>> getting invalid
>>
>> (as far as I see it, that seems to be a design flaw of DKIM)
>
>
>No we dont have courier MTA, its just postfix
>
>
>>
>>
>> --
>> Matus UHLAR - fantomas, uhlar [at] fantomas ; http://www.fantomas.sk/
>> Warning: I wish NOT to receive e-mail advertising to this address.
>> Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
>> Eagles may soar, but weasels don't get sucked into jet engines.

any filter changing content of those messages?

--
Matus UHLAR - fantomas, uhlar [at] fantomas ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
The early bird may get the worm, but the second mouse gets the cheese.


ryann.braganza at gmail

Jul 18, 2013, 4:14 AM

Post #7 of 11 (163 views)
Permalink
Re: T_DKIM_INVALID for gmail ?? [In reply to]

On Thu, Jul 18, 2013 at 4:25 PM, Matus UHLAR - fantomas
<uhlar [at] fantomas>wrote:

> On 18.07.13 16:21, Ryan Braganza wrote:
>
>> On Thu, Jul 18, 2013 at 4:17 PM, Matus UHLAR - fantomas
>> <uhlar [at] fantomas>wrote:
>>
>> On 18.07.13 16:01, Ryan Braganza wrote:
>>>
>>>>
>>>>> Why is T_DKIM_INVALID getting triggered for gmail ? I have seen this
>>>>>> happening many times with my servers, the dkim gets passed , then why
>>>>>> does
>>>>>> this invalid rule hit? Any inputs? am using SpamAssassin version
>>>>>> 3.3.2
>>>>>>
>>>>>>
>>>>> On Thu, Jul 18, 2013 at 4:03 PM, Matus UHLAR - fantomas
>>>
>>>> <uhlar [at] fantomas>wrote:
>>>>
>>>> are you getting those mails from gmail directly, without forwarding by
>>>>> anyone?
>>>>>
>>>>>
>>>> On 18.07.13 16:05, Ryan Braganza wrote:
>>>
>>> Hi thanks for the reply, these mails 1st come to an MX server and from
>>>> there to the spamasasin server.
>>>>
>>>>
>>> isn't the server by any change running courier MTA?
>>> some versions used to reformat some of mime headers which results in DKIM
>>> getting invalid
>>>
>>> (as far as I see it, that seems to be a design flaw of DKIM)
>>>
>>
>>
>> No we dont have courier MTA, its just postfix
>>
>>
>>
>>>
>>> --
>>> Matus UHLAR - fantomas, uhlar [at] fantomas ; http://www.fantomas.sk/
>>> Warning: I wish NOT to receive e-mail advertising to this address.
>>> Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
>>> Eagles may soar, but weasels don't get sucked into jet engines.
>>>
>>
> any filter changing content of those messages?
>
> No filtering on the MX as well as the spamassasin server. I guess as you
stated earlier DKIM is at fault here

>
> --
> Matus UHLAR - fantomas, uhlar [at] fantomas ; http://www.fantomas.sk/
> Warning: I wish NOT to receive e-mail advertising to this address.
> Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
> The early bird may get the worm, but the second mouse gets the cheese.


ryann.braganza at gmail

Jul 18, 2013, 4:24 AM

Post #8 of 11 (162 views)
Permalink
Re: T_DKIM_INVALID for gmail ?? [In reply to]

On Thu, Jul 18, 2013 at 4:44 PM, Ryan Braganza <ryann.braganza [at] gmail>wrote:

>
> On Thu, Jul 18, 2013 at 4:25 PM, Matus UHLAR - fantomas <uhlar [at] fantomas
> > wrote:
>
>> On 18.07.13 16:21, Ryan Braganza wrote:
>>
>>> On Thu, Jul 18, 2013 at 4:17 PM, Matus UHLAR - fantomas
>>> <uhlar [at] fantomas>wrote:
>>>
>>> On 18.07.13 16:01, Ryan Braganza wrote:
>>>>
>>>>>
>>>>>> Why is T_DKIM_INVALID getting triggered for gmail ? I have seen this
>>>>>>> happening many times with my servers, the dkim gets passed , then why
>>>>>>> does
>>>>>>> this invalid rule hit? Any inputs? am using SpamAssassin version
>>>>>>> 3.3.2
>>>>>>>
>>>>>>>
>>>>>> On Thu, Jul 18, 2013 at 4:03 PM, Matus UHLAR - fantomas
>>>>
>>>>> <uhlar [at] fantomas>wrote:
>>>>>
>>>>> are you getting those mails from gmail directly, without forwarding by
>>>>>> anyone?
>>>>>>
>>>>>>
>>>>> On 18.07.13 16:05, Ryan Braganza wrote:
>>>>
>>>> Hi thanks for the reply, these mails 1st come to an MX server and from
>>>>> there to the spamasasin server.
>>>>>
>>>>>
>>>> isn't the server by any change running courier MTA?
>>>> some versions used to reformat some of mime headers which results in
>>>> DKIM
>>>> getting invalid
>>>>
>>>> (as far as I see it, that seems to be a design flaw of DKIM)
>>>>
>>>
>>>
>>> No we dont have courier MTA, its just postfix
>>>
>>>
>>>
>>>>
>>>> --
>>>> Matus UHLAR - fantomas, uhlar [at] fantomas ; http://www.fantomas.sk/
>>>> Warning: I wish NOT to receive e-mail advertising to this address.
>>>> Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
>>>> Eagles may soar, but weasels don't get sucked into jet engines.
>>>>
>>>
>> any filter changing content of those messages?
>>
>> No filtering on the MX as well as the spamassasin server. I guess as you
> stated earlier DKIM is at fault here
>

Why do you ask if the mails are being forwareded or not? as i said earlier
we have an MX that transports the mail to a spamassasin box could this be
one of the reasons?

>
>> --
>> Matus UHLAR - fantomas, uhlar [at] fantomas ; http://www.fantomas.sk/
>> Warning: I wish NOT to receive e-mail advertising to this address.
>> Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
>> The early bird may get the worm, but the second mouse gets the cheese.
>
>
>


KMcGrail at PCCC

Jul 18, 2013, 4:25 AM

Post #9 of 11 (161 views)
Permalink
Re: T_DKIM_INVALID for gmail ?? [In reply to]

On 7/18/2013 6:51 AM, Ryan Braganza wrote:
> On Thu, Jul 18, 2013 at 4:17 PM, Matus UHLAR - fantomas
> <uhlar [at] fantomas <mailto:uhlar [at] fantomas>> wrote:
>
> On 18.07.13 16:01, Ryan Braganza wrote:
>
> Why is T_DKIM_INVALID getting triggered for gmail ? I
> have seen this
> happening many times with my servers, the dkim gets
> passed , then why does
> this invalid rule hit? Any inputs? am using
> SpamAssassin version 3.3.2
>
>
> On Thu, Jul 18, 2013 at 4:03 PM, Matus UHLAR - fantomas
> <uhlar [at] fantomas <mailto:uhlar [at] fantomas>>wrote:
>
> are you getting those mails from gmail directly, without
> forwarding by
> anyone?
>
>
> On 18.07.13 16:05, Ryan Braganza wrote:
>
> Hi thanks for the reply, these mails 1st come to an MX server
> and from
> there to the spamasasin server.
>
>
> isn't the server by any change running courier MTA?
> some versions used to reformat some of mime headers which results
> in DKIM
> getting invalid
>
> (as far as I see it, that seems to be a design flaw of DKIM)
>
>
> No we dont have courier MTA, its just postfix
I concur with Ryan. I've sent two tests and I'm seeing a DKIM failure
from Gmail as well.

I know it has been working before, etc. etc.

I'm going to look at trapping the message and checking on command line.


uhlar at fantomas

Jul 18, 2013, 6:02 AM

Post #10 of 11 (162 views)
Permalink
Re: T_DKIM_INVALID for gmail ?? [In reply to]

Please,

remove useless parts of the message. It's really hard to read it if you
quote everything and you can get trapped into responding the same mail
twice, and even wondering why I asked something you have replied already.

>>>> On 18.07.13 16:01, Ryan Braganza wrote:
>>>>>>>> Why is T_DKIM_INVALID getting triggered for gmail ? I have seen this
>>>>>>>> happening many times with my servers, the dkim gets passed , then why
>>>>>>>> does
>>>>>>>> this invalid rule hit? Any inputs? am using SpamAssassin version
>>>>>>>> 3.3.2

>>>>>> On Thu, Jul 18, 2013 at 4:03 PM, Matus UHLAR - fantomas <uhlar [at] fantomas> wrote:
>>>>>>> are you getting those mails from gmail directly, without forwarding by
>>>>>>> anyone?

>>>>> On 18.07.13 16:05, Ryan Braganza wrote:
>>>>>> Hi thanks for the reply, these mails 1st come to an MX server and from
>>>>>> there to the spamasasin server.

>>>> On Thu, Jul 18, 2013 at 4:17 PM, Matus UHLAR - fantomas
>>>> <uhlar [at] fantomas> wrote:
>>>>> isn't the server by any change running courier MTA?
>>>>> some versions used to reformat some of mime headers which results in
>>>>> DKIM
>>>>> getting invalid
>>>>>
>>>>> (as far as I see it, that seems to be a design flaw of DKIM)

>>> On 18.07.13 16:21, Ryan Braganza wrote:
>>>> No we dont have courier MTA, its just postfix

>> On Thu, Jul 18, 2013 at 4:25 PM, Matus UHLAR - fantomas <uhlar [at] fantomas> wrote:
>>> any filter changing content of those messages?

>On Thu, Jul 18, 2013 at 4:44 PM, Ryan Braganza <ryann.braganza [at] gmail>wrote:
>> No filtering on the MX as well as the spamassasin server. I guess as you
>> stated earlier DKIM is at fault here

On 18.07.13 16:54, Ryan Braganza wrote:
>Why do you ask if the mails are being forwareded or not? as i said earlier
>we have an MX that transports the mail to a spamassasin box could this be
>one of the reasons?

I have asked it before and you have already responded. You are replying your
own mail and asking about something that is not actual anymore.

It's possible that mail forwarding breaks DKIM, either by forwarding
modifying content of the message or headers, or by MTA modifying headers
(e.g. case conversion, adding/removinfg whitespace).

--
Matus UHLAR - fantomas, uhlar [at] fantomas ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
I intend to live forever - so far so good.


KMcGrail at PCCC

Jul 18, 2013, 9:38 AM

Post #11 of 11 (149 views)
Permalink
Re: T_DKIM_INVALID for gmail ?? [In reply to]

On 7/18/2013 7:25 AM, Kevin A. McGrail wrote:
> I concur with Ryan. I've sent two tests and I'm seeing a DKIM failure
> from Gmail as well.
>
> I know it has been working before, etc. etc.
>
> I'm going to look at trapping the message and checking on command line.
Sometime between 10:30~ and 12:30~ EDT, this stopped.

I'm guessing Google made an error with their DNS.

Attached is a zip if we see this again where I captured an email from
Gmail before ANYTHING had been parsed and after delivery.

Originally it was failing DKIM but as of 12:30PM is now passing.

Ryan, do you see gmail coming through validly signed now?

If it happens again, I'll have things prepped to see it's on Google's
end or not.

Regards,
KAM
Attachments: DKIM.zip (3.82 KB)

SpamAssassin users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.