Subject: Re: [dmarc-ietf] DMARC,SPF, null senders, and indirect mail flow

From: Anne Bennett <[email-masked]>
Date: Fri, 01 May 2015 11:55:15 -0400

Franck Martin <[email-masked]> writes:

> Note that postfix/sendmail can DKIM sign the bounces it creates.

A few weeks ago I searched for documentation on how to make
Sendmail sign its bounces, and I failed to find anything.
If you could point me at any document at all as a starting
point for that, I'd be grateful.

Anne.
-- 
Ms. Anne Bennett, Senior Sysadmin, ENCS, Concordia University, Montreal H3G 1M8
[email-masked]                                    +1 514 848-2424 x2285

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 1 May 2015 09:54:07 -0700

> point for that, I'd be grateful.

DKIM signing in sendmail is done via its milter API, which is instantiated
only when traffic arrives via SMTP.  DSNs are generated and queued
internally, not via SMTP.  Thus sendmail does not sign its bounces.  The
only way to do that would be to have the sendmail instance generating the
DSN route the DSN through a second MTA on its way out, and that second one
would do the signing.

I have no idea if any of that is true for postfix, but I believe it has
hooks for calling milter APIs even for non-SMTP messages.

-MSK

---

From: Franck Martin <[email-masked]>
Date: Fri, 1 May 2015 10:06:29 -0700

> On May 1, 2015, at 9:54 AM, Murray S. Kucherawy <[email-masked]> wrote:
> 
> On Fri, May 1, 2015 at 8:55 AM, Anne Bennett <[email-masked] <mailto:[email-masked]>> wrote:
> 
> Franck Martin <[email-masked] <mailto:[email-masked]>> writes:
> DKIM signing in sendmail is done via its milter API, which is instantiated only when traffic arrives via SMTP.  DSNs are generated and queued internally, not via SMTP.  Thus sendmail does not sign its bounces.  The only way to do that would be to have the sendmail instance generating the DSN route the DSN through a second MTA on its way out, and that second one would do the signing.
> 
> I have no idea if any of that is true for postfix, but I believe it has hooks for calling milter APIs even for non-SMTP messages.
> 

http://www.postfix.org/MILTER_README.html <http://www.postfix.org/MILTER_README.html>
Signing internally-generated bounce messages
Postfix normally does not apply content filters to mail that is generated internally such as bounces or Postmaster notifications. Filtering internally-generated bounces would result in loss of mail when a filter rejects a message, as the resulting double-bounce message would almost certainly also be blocked. 

To sign Postfix's own bounce messages, enable filtering of internally-generated bounces (line 2 below), and don't reject any internally-generated bounces with non_smtpd_milters <http://www.postfix.org/postconf.5.html#non_smtpd_milters>, header_checks <http://www.postfix.org/postconf.5.html#header_checks> or body_checks <http://www.postfix.org/postconf.5.html#body_checks> (lines 3-5 below). 

1 /etc/postfix/main.cf <http://www.postfix.org/postconf.5.html>:
2     internal_mail_filter_classes <http://www.postfix.org/postconf.5.html#internal_mail_filter_classes> = bounce
3     non_smtpd_milters <http://www.postfix.org/postconf.5.html#non_smtpd_milters> = don't reject internally-generated bounces
4     header_checks <http://www.postfix.org/postconf.5.html#header_checks> = don't reject internally-generated bounces
5     body_checks <http://www.postfix.org/postconf.5.html#body_checks> = don't reject internally-generated bounces

---

From: Anne Bennett <[email-masked]>
Date: Mon, 04 May 2015 11:35:51 -0400

FM = Franck Martin <[email-masked]>
AB = Anne Bennett <[email-masked]>
MK = Murray S. Kucherawy <[email-masked]>

FM>>>> Note that postfix/sendmail can DKIM sign the bounces it creates.

AB>>> A few weeks ago I searched for documentation on how to make
AB>>> Sendmail sign its bounces, and I failed to find anything.
AB>>> If you could point me at any document at all as a starting
AB>>> point for that, I'd be grateful.

MK>> DKIM signing in sendmail is done via its milter API, which
MK>> is instantiated only when traffic arrives via SMTP.  DSNs are
MK>> generated and queued internally, not via SMTP.  Thus sendmail
MK>> does not sign its bounces.

That was the conclusion I had come to.

MK>> The only way to do that would be
MK>> to have the sendmail instance generating the DSN route the
MK>> DSN through a second MTA on its way out, and that second one
MK>> would do the signing.

Oooh, ick, but that would work.  I'll keep it in mind.  Thank you.

FM> http://www.postfix.org/MILTER_README.html
[...]
FM> To sign Postfix's own bounce messages, enable filtering of
FM> internally-generated bounces (line 2 below), and don't reject any
FM> internally-generated bounces with non_smtpd_milters

Okay, so Postfix can do it more straightforwardly.  Good to
know, and thank you too.

Anne.