Re: [dmarc-ietf] DMARC2 & SPF Dependency Removal

[Tero Kivinen <[e-mail]>]

Alessandro Vesely writes:
> On Tue 13/Jun/2023 23:33:50 +0200 Tero Kivinen wrote:
> > [...]
> >
> > As you can see 85.75% of incoming email was already signed by DKIM,
> > and 86.5% of emails had SPF records that passed. So they both have
> > about same amount if usage coming in to our servers.
> 
> 
> What are those 0.75%, some 30k SPF - DKIM messages?  Are there cases of DKIM 
> random failure salvaged by SPF?

My current analysis script does not try to calculate that, I would
need to need to add that step there and rerun the script. If I
understand correctly you would like to see cases where if there is
both SPF and DKIM, the cases where the both, only one, or neither
passed, and how many of those cases would be where dkim=fail, but
spf=pass?

I will try to see if I can run the that check later.

> > 	0.19%	7506	none,pass
> > 	0.15%	5910	pass,none
> 
> How do you order DKIM signatures?

My understanding is that rspamd most likely uses the order of DKIM
signatures in the email body. On the other hand order does not matter,
as if ANY of the dkim checks pass, then the whole message passes. The
reason I printed out the combinations of different dkim results was to
show that there are cases where there is multiple dkim headers and
some of those pass and some fail.

I.e there were:

0.00%	4	pass,fail,fail,fail,fail
0.00%	2	pass,pass,pass,pass,pass,pass

I.e. four emails had five dkim records, four of them failing and one
passing, where another two one had six dkim records all passing. Most
of the emails had oly one dkim record, and those of which had two most
of them were so that both passed.
-- 
[e-mail]