Subject: [dmarc-ietf] bounces on postfix...

From: Franck Martin <[email-masked]>
Date: Thu, 20 Jun 2013 21:22:00 +0000

Well as people are having too much fun with DNS (clear your cache), I tried to install postfix and opendkim and faced the usual bounce issue.

So out of the box, postfix bounce templates have the following in the from: field
From: MAILER-DAEMON (Mail Delivery System)
so as you suspect, this is not aligned, does not have a domain name etc.. which seems to get opendkim not to sign the email.

you need to create custom templates and put an email address there, something like
From: [email-masked]
So it can be dkim signed on the way out.

This link indicates the config for custom bounce templates: http://www.howtoforge.com/configure-custom-postfix-bounce-messages

But I could not find any site explaining the config to make sure postfix bounces are signed (and aligned). Still I'm not fully sure I have a correct config yet. Will post some more later... or any help appreciated.

---

From: Birta Levente <[email-masked]>
Date: Fri, 21 Jun 2013 09:50:57 +0300

On 21/06/2013 00:22, Franck Martin wrote:
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc
>

The bounces does not go through milters and content_filters ... so 
bounces never be signed.
And, I think, bounces will never be considered message that aligned/not 
aligned because is system message.

Levi

---

From: Franck Martin <[email-masked]>
Date: Fri, 21 Jun 2013 13:43:18 +0000

On Jun 20, 2013, at 11:50 PM, Birta Levente <[email-masked]> wrote:

> The bounces does not go through milters and content_filters ... so bounces never be signed.
> And, I think, bounces will never be considered message that aligned/not aligned because is system message.
> 

looks like a design problem with postfix if you can't dkim sign all emails it sends.

I thought this was the intent of these two parameters
 smtpd_milters
 non_smtpd_milters

With the last one to handle such "bounce" emails.

---

From: Franck Martin <[email-masked]>
Date: Fri, 21 Jun 2013 15:17:04 +0000

> With the last one to handle such "bounce" emails.

http://www.postfix.org/MILTER_README.html
"Postfix currently does not apply content filters to mail that is forwarded or aliased internally, or to mail that is generated internally such as bounces or Postmaster notifications. This may be a problem when you want to apply a signing Milter to such mail. "

So with postfix, no DKIM signing for bounces... bugger!

So it is important to have the SPF part of DKIM aligned, which means, putting a SPF record on the hostname which is presented in the HELO/EHLO as well as to do custom templates to ensure the From: contains an email address.