Date: Sat, 22 Feb 2025 12:47:39 -0500
From: Bruce Momjian <bruce@momjian.us>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Stefan Kaltenbrunner <stefan@kaltenbrunner.cc>,
	Matthias Apitz <gurucubano@googlemail.com>,
	pgsql-bugs@lists.postgresql.org,
	Magnus Hagander <magnus@hagander.net>
Subject: Re: BUG #18822: mailing lists reject mails due to DKIM-signature
Message-ID: <Z7oNu1KTYbb5F8np@momjian.us>
References: <18822-25d115fe42e642c2@postgresql.org>
 <7d1cf55f-4228-49d8-8066-cf96deab8ad3@kaltenbrunner.cc>
 <CAHzebO8PGHFB8e7_5bYc=HefWo5rr7dhuMLg-zmGLmaRWxW5aQ@mail.gmail.com>
 <c5be0df1-8953-4531-81dd-9395082883d9@kaltenbrunner.cc>
 <82011.1740245157@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <82011.1740245157@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/Z7oNu1KTYbb5F8np%40momjian.us>
Precedence: bulk

On Sat, Feb 22, 2025 at 12:25:57PM -0500, Tom Lane wrote:
> Stefan Kaltenbrunner <stefan@kaltenbrunner.cc> writes:
> > On 22.02.25 17:56, Matthias Apitz wrote:
> >> Have you read what the RFC 6576 specifies about exactly this case?
> 
> > we are a forwarder that (in the case of a List-* header) NEEDS to modify 
> > the message so we cannot forward it without breaking.
> 
> Yeah.  Regardless of what may be written in the RFC, there are only
> these possibilities when the mailing list forwarder receives a
> message like this:
> 
> 1. Add the PG list headers, don't touch the DKIM header, forward.
> Most modern recipients will reject the result as spam because it
> fails DKIM checks.
> 
> 2. Don't add the PG list headers, don't touch the DKIM header,
> forward.  Many list recipients will discard or at least
> misclassify the result for lack of PG list headers.
> 
> 3. Add the PG list headers, discard the DKIM header, forward.
> This may well end up marked as spam too, and it's certainly
> not complying with the intent of DKIM.
> 
> 4. Reject the message.
> 
> To the extent that including List-* in a DKIM signature has any
> real-world use, it is precisely to disavow the message if it's
> forwarded by a mailing list.
> 
> The short answer here is that your ISP are fools, or else are
> intentionally preventing their users from participating in
> mailing lists.

I will admit I was shocked to realize I have to modify the default
Debian exim4 DKIM header signing to submit to email lists, and I am
confused why there is a header signing default on Debian that includes
List-* headers.

With the help of Magnus, I was able to use this script:

	exim -bP macros | grep '^_DKIM_SIGN_HEADERS=' | sed --regexp-extended 's/:?\<(Resent-|List-)[^:]*//g'

to prevent signing of all Resent and List headers, and use this line in
exim4.conf.localmacros:

	DKIM_SIGN_HEADERS=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description:In-Reply-To:References

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EDB                                      https://enterprisedb.com

  Do not let urgent matters crowd out time for investment in the future.