[Rspamd-Users] Received: lines being reordered on DKIM check?
Steve Watt
steve at watt.com
Wed Apr 28 23:33:56 UTC 2021
Greetings!
It appears that rspamd is somehow relocating a Received: header during DKIM
signature checking, but I'm not 100% sure.
System environment: FreeBSD 12.2p6, Sendmail, rspamd the trailing milter in
my configuration (the other ones are my message logger, milter-regex, and
ClamAV, in order). The user delivery happens via Procmail and Dovecot
deliver. Lotta places where things could go wrong, I recognize.
The message logger is something I wrote to preserve mail content as it
arrives, before Sendmail gets to it. I use it to generate reliable spam
reports, as well as debugging various weird mail issues over the . uh,
decades.
Reordering Received: headers breaks spamcop reporting, as it makes it
impossible for their system to determine where my system received the
incoming messages.
With that introduction, I have the following mail in my message log for a
sample victim message. The FROM and RCPT are from the SMTP commands.
-- Tue Apr 27 23:20:51 2021
Connect from s1-ba8d.socketlabs.email-od.com, TLSv1.2
(s1-ba8d.socketlabs.email-od.com [142.0.186.141])
FROM <2bf8.82.15f9d00014096f6.c396624901ad3f7720b1b7e4be7c27cd at email-od.com>
(1 argument)
RCPT <XXXX at XXXX.XXXXXXXX.NET> (1 argument)
DKIM-Signature: v=1; a=rsa-sha256; d=lplmod.com;s=deluxe;
c=relaxed/relaxed; q=dns/txt; t=1619590852; x=1622182852;
h=message-id:content-type:subject:date:to:from:mime-version:reply-to:x-threa
d-info;
bh=XLmDLZb2krpQlRZqjDXnbm4vOV6wbe3iIa/e6lRvjJk=;
b=lSqzkgqh/rhuVd3jGwetCs2OJYMhv+UhIiCR2BJZpaQyWTVDgXakD7oZd2v+OmJEhjj3kdjITC
JBq/vMSqSgWTVXOaoM8/3A+jNYRsVPmChHuGV3H9i/azDaMiQAAzdgQZ1eRLnWirVdaLqZOFR6vR
gfc/Ysr5+ipajKdIsbgFQW09AInYEwqj+JriGSLk9+oHi7go8rUOYLnR7BlfdYPNtJj2geu+NqP3
6QIy9hJS4ORetp7Z7E8FsGOcv+aPihdEHfpy3UgLvsqbNI3Up+o3kaEXvmUverz3i4hD9Al9Fqkm
LzWk7RFYUCbX8CWbFN90rYiaxlbCsw7TkAb1cG6Q==
DKIM-Signature: v=1; a=rsa-sha256; d=email-od.com;i=@email-od.com;s=dkim;
c=relaxed/relaxed; q=dns/txt; t=1619590852; x=1622182852;
h=message-id:content-type:subject:date:to:from:mime-version:reply-to:x-threa
d-info;
bh=XLmDLZb2krpQlRZqjDXnbm4vOV6wbe3iIa/e6lRvjJk=;
b=oUtTmD5NODl8Ti6Oa0fVK2+sgAVYBSWCN05NpM0tz3+7CNjNgh1hPsVpJYBM/caF3MBEdwwgMZ
8zeJm3sXEhYdnBVKXl709XZMI9gHH+dSKVIBcP9mxDCRPcerQS7LDoe9aRu2vu9CNFdwjOkVxxRn
FkIte6CXeJyXIRPJwYfN0=
X-Thread-Info:
MmJmOC4xZS4xNWY5ZDAwMDE0MDk2ZjYuMzE5Nlg0NTc2OTQuMzE5Nlg5MDM1LlRFQ0g9U1RFVkUu
V0FUVExJTksuTkVU
Received: from r2.us-west-2.aws.in.socketlabs.com
(r2.us-west-2.aws.in.socketlabs.com [142.0.190.2]) by mxrs4.email-od.com
with ESMTP(version=Tls12 cipher=Aes256 bits=256); Wed, 28 Apr 2021
01:20:33 -0400
Received: from 127.0.0.1 (ec2-13-57-112-89.us-west-1.compute.amazonaws.com
[13.57.112.89]) by r2.us-west-2.aws.in.socketlabs.com
with ESMTP; Wed, 28 Apr 2021 01:19:37 -0400
Received: from PRD-AppFW ([127.0.0.1]) by 127.0.0.1 with Microsoft
SMTPSVC(8.0.9200.16384);
Tue, 27 Apr 2021 22:19:37 -0700
Reply-To: automation at lplmod.com
MIME-Version: 1.0
From: "FirstName123 LastName123" <automation at lplmod.com>
To: XXXX at XXXX.XXXXXXXX.NET
Date: 27 Apr 2021 22:19:37 -0700
Subject: Weekly Market Commentary
Content-Type: multipart/alternative;
boundary=--boundary_29600678_75a5c3f2-beab-4f40-8c1b-08b2b6921452
Return-Path: automation at lplmod.com
Message-ID: <PRD-APPFWQbPmhjM8os037fa3e8 at 127.0.0.1>
X-OriginalArrivalTime: 28 Apr 2021 05:19:37.0345 (UTC)
FILETIME=[1520DF10:01D73BEE]
This is a multipart message in MIME format.
And this is what appeared in the user mailbox (post rspamd, post
procmail/Dovecot-Deliver):
Received: from r2.us-west-2.aws.in.socketlabs.com
(r2.us-west-2.aws.in.socketlabs.com [142.0.190.2]) by mxrs4.email-od.com
with ESMTP(version=Tls12 cipher=Aes256 bits=256); Wed, 28 Apr 2021
01:20:33 -0400
Received: from s1-ba8d.socketlabs.email-od.com
(s1-ba8d.socketlabs.email-od.com [142.0.186.141])
by [myserver].watt.com (8.16.1/8.16.1) with ESMTPS id 13S6KmI8086214
(version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NO)
for <XXXX at XXXX.XXXXXXXX.NET>; Tue, 27 Apr 2021 23:20:51 -0700 (PDT)
(envelope-from
2bf8.82.15f9d00014096f6.c396624901ad3f7720b1b7e4be7c27cd at email-od.com)
Received: from PRD-AppFW ([127.0.0.1]) by 127.0.0.1 with Microsoft
SMTPSVC(8.0.9200.16384);
Tue, 27 Apr 2021 22:19:37 -0700
Received: from 127.0.0.1 (ec2-13-57-112-89.us-west-1.compute.amazonaws.com
[13.57.112.89])
by r2.us-west-2.aws.in.socketlabs.com
with ESMTP; Wed, 28 Apr 2021 01:19:37 -0400
Reply-To: <automation at lplmod.com>
From: "FirstName123 LastName123" <automation at lplmod.com>
To: <XXXX at XXXX.XXXXXXXX.NET>
Subject: Weekly Market Commentary
Date: Tue, 27 Apr 2021 22:19:37 -0700
Message-ID: <PRD-APPFWQbPmhjM8os037fa3e8 at 127.0.0.1>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_023F_01D73C3F.ECA40F60"
X-Mailer: Microsoft Outlook 16.0
X-Archived: 1619590851.488821212@[myserver].watt.com
X-Rspamd-Queue-Id: 13S6KmI8086214
X-Spamd-Result: default: False [6.00 / 15.00];
HAS_REPLYTO(0.00)[automation at lplmod.com];
R_SPF_ALLOW(-0.20)[+ip4:142.0.176.0/20];
REPLYTO_ADDR_EQ_FROM(0.00)[];
TO_DN_NONE(0.00)[];
MIME_BASE64_TEXT_BOGUS(1.00)[];
RCVD_COUNT_THREE(0.00)[4];
DKIM_TRACE(0.00)[lplmod.com:+,email-od.com:+];
MIME_BASE64_TEXT(0.10)[];
DMARC_POLICY_ALLOW(-0.50)[lplmod.com,quarantine];
FORGED_SENDER(0.30)[automation at lplmod.com,2bf8.82.15f9d00014096f6.c396624901
ad3f7720b1b7e4be7c27cd at email-od.com];
MIME_TRACE(0.00)[0:+,1:+,2:~];
RCVD_TLS_LAST(0.00)[];
HAS_DATA_URI(0.00)[];
ASN(0.00)[asn:27357, ipnet:142.0.184.0/22, country:US];
FROM_NEQ_ENVFROM(0.00)[automation at lplmod.com,2bf8.82.15f9d00014096f6.c396624
901ad3f7720b1b7e4be7c27cd at email-od.com];
DWL_DNSWL_NONE(0.00)[email-od.com:dkim];
ARC_NA(0.00)[];
R_PARTS_DIFFER(1.00)[100.0%];
R_DKIM_ALLOW(-0.20)[lplmod.com:s=deluxe,email-od.com:s=dkim];
BAYES_HAM(-0.40)[77.83%];
FROM_HAS_DN(0.00)[];
EXT_CSS(1.00)[];
TO_MATCH_
ENVRCPT_ALL(0.00)[];
MIME_GOOD(-0.10)[multipart/alternative,text/plain];
DCC_REJECT(2.00)[bulk Body=2 Fuz1=many Fuz2=many rep=43% ];
RCPT_COUNT_ONE(0.00)[1];
RCVD_IN_DNSWL_NONE(0.00)[142.0.186.141:from,142.0.190.2:received];
NEURAL_HAM(-0.00)[-0.075];
MID_BARE_IP(2.00)[];
GREYLIST(0.00)[pass,body]
X-Rspamd-Server: [myserver].watt.com
Thread-Index: AQHuXfoAxb12HzsxxoxEHkUjbCrPPg==
X-OlkEid:
000000004E54284C7D342340818A7240D59EC7E1070034AD76187591974DBF6C4F76951C873A
01005300000000003318C3580047674EA0507EDC1854346100000000AA2E000080C5333892A0
354CBA85384A024C75AB
X-Thread-Info:
MmJmOC4xZS4xNWY5ZDAwMDE0MDk2ZjYuMzE5Nlg0NTc2OTQuMzE5Nlg5MDM1LlRFQ0g9U1RFVkUu
V0FUVExJTksuTkVU
X-OriginalArrivalTime: 28 Apr 2021 05:19:37.0345 (UTC)
FILETIME=[1520DF10:01D73BEE]
This is a multipart message in MIME format.
None of the other milters know anything about DKIM, and my .procmailrc
didn't trigger anything but a deliver recipe, so no formail runs or the
like.
I note the complete absence of the DKIM-Signature headers in the delivered
message, plus the movement of the mxrs4.email-od.com Received: header so
it's in front of the by [myserver] one.
So it appears that the Received: line is somehow migrating during DKIM
checking/stripping? But that's weird.
Thoughts? Is this an rspamd bug? Ideas on how to localize further?
Thanks,
--
Steve Watt KD6GGD PP-ASEL-IA factories.words.yappy
Don't let your schooling get in the way of your education.
More information about the Users
mailing list