Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1tmSNR-006ohq-Ju for pgsql-bugs@arkaria.postgresql.org; Mon, 24 Feb 2025 06:55:42 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1tmSNQ-00GSfZ-Av for pgsql-bugs@arkaria.postgresql.org; Mon, 24 Feb 2025 06:55:40 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1tmSNQ-00GSfR-0v for pgsql-bugs@lists.postgresql.org; Mon, 24 Feb 2025 06:55:40 +0000 Received: from mail-qv1-xf36.google.com ([2607:f8b0:4864:20::f36]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.96) (envelope-from ) id 1tmSNN-000UBN-0q for pgsql-bugs@lists.postgresql.org; Mon, 24 Feb 2025 06:55:39 +0000 Received: by mail-qv1-xf36.google.com with SMTP id 6a1803df08f44-6e6621960eeso49943686d6.0 for ; Sun, 23 Feb 2025 22:55:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20230601; t=1740380136; x=1740984936; darn=lists.postgresql.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=N1v458wjhfJbroE1Ay0qZclSLK/WxdYOtQHQXGKg2C0=; b=bFBzg5XHLzA+4JkEpBYR7CPSjdUJFSPPHQVoPUUSFVeF4ZIY9Lc4rKJMW6qS7d8RoB 8gUqENHfQQ7yYlm/RjE8g1MfvDLN323XIiV4f+RRKaY9T1aBTiZkR6jVfovnr1CiTax9 JrP/FPAx/8xzAVQ7Vhdy+H7qjzjcvnOS9r7pXtd4QSsMvtreto6ZfjGk5q3XDoqYAaUr rkUmqof3GYTe4ngR+03jMLq12+OKdJxhULjYQ2B+mysWY+CU/M5xtWhIzuaaJOYoaews W/0o9yHzvxx6A3n5QFEa/fFYoedSC/9ATuyDwOubXuvi54sTkwLQy3PNbHXjtCnApNS+ mxOg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1740380136; x=1740984936; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=N1v458wjhfJbroE1Ay0qZclSLK/WxdYOtQHQXGKg2C0=; b=HRJjE75pChrbPxHE4UxWT0nwtzuANiFOeYLPaLhr62KwpI6426fDMlFtD9P+H1/6d5 b9cjpUI4ft9wP2L2QwS5K62vLIMDcbsPnkOGwAr6/sOLjyZPmaSCCCNGH0/8vui0I4RX gf0ygtd3VakQH+KMi+3CmwcTuCo5a/XnleYb2UwDywDcHgn0StEvBcOSfyrto9GdsL83 q7KYR79iBSBEenf2xMVHYD/WHU8XEZgkOWhQn3FrYbG46bWh5zfkAaWx/B1YklrEY5iY vsHiLVUePdAwj8qbAvbkSecWgamNT+X+BJpVJKsYj6gb2kegmSTate811OuLOHMlAxUI clsw== X-Forwarded-Encrypted: i=1; AJvYcCV5FAyg0MxJMhPQ8H+0M8HG95jSUtOvwvNhokKS9eGIvFrO0UxagsR2OmFvdzOBRsHJiUnah6FfY4+Z@lists.postgresql.org X-Gm-Message-State: AOJu0Yzzz4x+b9yD006l2dS519vKEYSxzwq8iy6Q2c8l7o3iGbN+buMy zafJ0+WuW7kC3ORerdZyTEVRRXpymNdqarCuoljPDjdraunQtZ1T/p5qyV606eaHGn+ja7mDqLA C0Jxw8TiU6Pi4JNWZjB1frB8DRdA= X-Gm-Gg: ASbGnctLBa8uO5Jci3zwjHHOyhL15tfdgbR74kKlLGB8BXNIqLNb+Tf5LH7k/CJzXnW y+Q0P3IBaamyUivT/qDvuvNNokaD9w1dUfKjQ2ynMYyfHmYdeO6t4BsWnFPDHfSmunP8GJ5PKfp +cZr4ueByWPBgT9f8k5dVxwUvrsXyVBWfJtDGvgZo= X-Google-Smtp-Source: AGHT+IFwqhgmffJfbjvTdfIrQcQdweYh0l7TbTnlCP/B9OHKu7VJyIcfqTqYZbZ2N3tK7aMv5ObfOXVQtmqKdA7XD5Q= X-Received: by 2002:a05:6214:e6a:b0:6e4:3455:eba3 with SMTP id 6a1803df08f44-6e6ae778adbmr130235886d6.6.1740380135691; Sun, 23 Feb 2025 22:55:35 -0800 (PST) MIME-Version: 1.0 References: <18822-25d115fe42e642c2@postgresql.org> <7d1cf55f-4228-49d8-8066-cf96deab8ad3@kaltenbrunner.cc> <82011.1740245157@sss.pgh.pa.us> In-Reply-To: From: Matthias Apitz Date: Mon, 24 Feb 2025 07:55:25 +0100 X-Gm-Features: AWEUYZmuMsmPQwoMPGezZJMzCmBTR1wkLDrKkjsTAiuBXSY05-ZsHq175DMLeas Message-ID: Subject: Re: BUG #18822: mailing lists reject mails due to DKIM-signature To: Bruce Momjian Cc: Tom Lane , Stefan Kaltenbrunner , pgsql-bugs@lists.postgresql.org, Magnus Hagander Content-Type: multipart/alternative; boundary="000000000000c322a4062eddd3b8" List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --000000000000c322a4062eddd3b8 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I'm subscribed to some hundred technical mailing lists and do not face this problem with any other list, only with the PostgreSQL lists. For example, when I write to the list mutt-users@mutt.org and my ISP 1blu.de sends the same DKIM-Signature containing these List-* entries (which might be there or not, what I count a religious war depending of how one reads the RFC in question), what gets delivered by the mutt-users@mutt.org list server to the subscribers, like me, DKIM related is only: grep ^DKIM mutt.mail DKIM-Filter: OpenDKIM Filter v2.11.0 smtp1.osuosl.org C3A51819CC DKIM-Filter: OpenDKIM Filter v2.11.0 smtp3.osuosl.org 5EB3A605E8 DKIM-Signature: v=3D1; a=3Drsa-sha256; q=3Ddns/txt; c=3Drelaxed/relaxed; On Sat, Feb 22, 2025 at 6:47=E2=80=AFPM Bruce Momjian wr= ote: > On Sat, Feb 22, 2025 at 12:25:57PM -0500, Tom Lane wrote: > > Stefan Kaltenbrunner writes: > > > On 22.02.25 17:56, Matthias Apitz wrote: > > >> Have you read what the RFC 6576 specifies about exactly this case? > > > > > we are a forwarder that (in the case of a List-* header) NEEDS to > modify > > > the message so we cannot forward it without breaking. > > > > Yeah. Regardless of what may be written in the RFC, there are only > > these possibilities when the mailing list forwarder receives a > > message like this: > > > > 1. Add the PG list headers, don't touch the DKIM header, forward. > > Most modern recipients will reject the result as spam because it > > fails DKIM checks. > > > > 2. Don't add the PG list headers, don't touch the DKIM header, > > forward. Many list recipients will discard or at least > > misclassify the result for lack of PG list headers. > > > > 3. Add the PG list headers, discard the DKIM header, forward. > > This may well end up marked as spam too, and it's certainly > > not complying with the intent of DKIM. > > > > 4. Reject the message. > > > > To the extent that including List-* in a DKIM signature has any > > real-world use, it is precisely to disavow the message if it's > > forwarded by a mailing list. > > > > The short answer here is that your ISP are fools, or else are > > intentionally preventing their users from participating in > > mailing lists. > > I will admit I was shocked to realize I have to modify the default > Debian exim4 DKIM header signing to submit to email lists, and I am > confused why there is a header signing default on Debian that includes > List-* headers. > > With the help of Magnus, I was able to use this script: > > exim -bP macros | grep '^_DKIM_SIGN_HEADERS=3D' | sed > --regexp-extended 's/:?\<(Resent-|List-)[^:]*//g' > > to prevent signing of all Resent and List headers, and use this line in > exim4.conf.localmacros: > > > DKIM_SIGN_HEADERS=3DFrom:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MI= ME-Version:Content-Type:Content-Transfer-Encoding:Content-ID:Content-Descri= ption:In-Reply-To:References > > -- > Bruce Momjian https://momjian.us > EDB https://enterprisedb.com > > Do not let urgent matters crowd out time for investment in the future. > --000000000000c322a4062eddd3b8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I'm subscribed to some hundred technical mailing = lists and do not face this problem with any other list, only with the Postg= reSQL lists. For example, when I write to the list mutt-users@mutt.org and my ISP 1blu.de sends the same DKIM-Signature containing these List-* entries= (which might be there or not, what I count a religious war depending of ho= w one reads the RFC in question), what gets delivered by the mutt-users@mutt.org list server to the subscri= bers, like me, DKIM related is only:

grep ^DKIM mu= tt.mail
DKIM-Filter: OpenDKIM Filter v2.11.0 smtp1.osuosl.org C3A51819CC
DKIM-Filter: OpenDKIM Fi= lter v2.11.0 smtp3.osuosl.org 5EB3A= 605E8
DKIM-Signature: v=3D1; a=3Drsa-sha256; q=3Ddns/txt; c=3Drelaxed/re= laxed;






On Sat, Feb 22, 2025 at 6:47=E2=80=AFPM B= ruce Momjian <bruce@momjian.us&g= t; wrote:
On Sat= , Feb 22, 2025 at 12:25:57PM -0500, Tom Lane wrote:
> Stefan Kaltenbrunner <stefan@kaltenbrunner.cc> writes:
> > On 22.02.25 17:56, Matthias Apitz wrote:
> >> Have you read what the RFC 6576 specifies about exactly this = case?
>
> > we are a forwarder that (in the case of a List-* header) NEEDS to= modify
> > the message so we cannot forward it without breaking.
>
> Yeah.=C2=A0 Regardless of what may be written in the RFC, there are on= ly
> these possibilities when the mailing list forwarder receives a
> message like this:
>
> 1. Add the PG list headers, don't touch the DKIM header, forward.<= br> > Most modern recipients will reject the result as spam because it
> fails DKIM checks.
>
> 2. Don't add the PG list headers, don't touch the DKIM header,=
> forward.=C2=A0 Many list recipients will discard or at least
> misclassify the result for lack of PG list headers.
>
> 3. Add the PG list headers, discard the DKIM header, forward.
> This may well end up marked as spam too, and it's certainly
> not complying with the intent of DKIM.
>
> 4. Reject the message.
>
> To the extent that including List-* in a DKIM signature has any
> real-world use, it is precisely to disavow the message if it's
> forwarded by a mailing list.
>
> The short answer here is that your ISP are fools, or else are
> intentionally preventing their users from participating in
> mailing lists.

I will admit I was shocked to realize I have to modify the default
Debian exim4 DKIM header signing to submit to email lists, and I am
confused why there is a header signing default on Debian that includes
List-* headers.

With the help of Magnus, I was able to use this script:

=C2=A0 =C2=A0 =C2=A0 =C2=A0 exim -bP macros | grep '^_DKIM_SIGN_HEADERS= =3D' | sed --regexp-extended 's/:?\<(Resent-|List-)[^:]*//g'=

to prevent signing of all Resent and List headers, and use this line in
exim4.conf.localmacros:

=C2=A0 =C2=A0 =C2=A0 =C2=A0 DKIM_SIGN_HEADERS=3DFrom:Sender:Reply-To:Subjec= t:Date:Message-ID:To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding= :Content-ID:Content-Description:In-Reply-To:References

--
=C2=A0 Bruce Momjian=C2=A0 <bruce@momjian.us>=C2=A0 =C2=A0 =C2=A0 =C2=A0 https://momjian.us=
=C2=A0 EDB=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 https:= //enterprisedb.com

=C2=A0 Do not let urgent matters crowd out time for investment in the futur= e.
--000000000000c322a4062eddd3b8--