Re: [Ietf-dkim] DKIM-Signature: r=y and MLM

[Дилян Палаузов <[e-mail]>]

PS:

> For example, the ietf.org mailing list has begun to rewrite and it 
> replaces the 5322.From with a dmarc.ietf.org domain, adds a new 
> X-Original-From header and resigns the message using an ietf.org 
> signer domain:
> 
>    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; 
> s=ietf1;
>       t=1537415189; bh=TJWGUVdPL8OTY+HJnUzpBRd52OaKfWjFqS68Cby0s/M=;
>       h=Date:To:References:In-Reply-To:Subject:List-Id:List-Unsubscribe:
>       List-Archive:List-Post:List-Help:List-Subscribe:From;
>       b=.....
>     X-Original-From: Hector Santos <[e-mail]>
>     From: Hector Santos <hsantos=[e-mail]>
> 
> What it should do is:
> 
>    1) It should use a 1st party signature using d=dmarc.ietf.org to
>       match the new author domain dmarc.ietf.org.
> 
>    2) It should has hash bind the X-Original-From header to the
>       signature.  Since DKIM recommends not to bind "X-" headers,
>       a non "X-" header should be used, i.e. "Original-From:".  This
>       means adding the header to the 'h=" field to avoid potential
>       mail resend exploits using different unprotected Original-from:
>       fields.
> 
>    3) and finally, the dmarc.ietf.org domain should have its own
>       DMARC p=reject policy to effectively replace the one it
>       circumvented with the submission.
> 

Please describe the handling, of the above message by the MLM, if the
original message contained in addition
  DKIM-Signature: v=1; d=isdg.net; r=y; …

... or something different than r=y, that permits finding faulty DKIM
implementations.


Apart from this, on the last email I sent “To: Hector Santos <
[e-mail]>, [e-mail]” , I got:

Date: Wed, 24 Oct 2018 20:32:15 GMT
From: Mail Delivery Subsystem <[e-mail]>
Message-Id: <[e-mail]>
Content-Type: multipart/report; report-type=delivery-status;
        boundary="w9OKWFSc027376.1540413135/mail.aegee.org"
Content-Transfer-Encoding: 8bit
Subject: Returned mail: see transcript for details
Auto-Submitted: auto-generated (failure)

This is a MIME-encapsulated message

--w9OKWFSc027376.1540413135/mail.aegee.org

The original message was received at Wed, 24 Oct 2018 20:32:10 GMT
from ipbcc2def0.dynamic.kabel-deutschland.de [188.194.222.240]

   ----- The following addresses had permanent fatal errors -----
<[e-mail]>
    (reason: 554 REJECTED BY SYSTEM POLICY FILTER)

   ----- Transcript of session follows -----
... while talking to mail.isdg.net.:
<<< 554 REJECTED BY SYSTEM POLICY FILTER
554 5.0.0 Service unavailable

--w9OKWFSc027376.1540413135/mail.aegee.org
Content-Type: message/delivery-status

Reporting-MTA: dns; mail.aegee.org
Received-From-MTA: DNS; ipbcc2def0.dynamic.kabel-deutschland.de
Arrival-Date: Wed, 24 Oct 2018 20:32:10 GMT

Final-Recipient: RFC822; [e-mail]
Action: failed
Status: 5.5.0
Diagnostic-Code: SMTP; 554 REJECTED BY SYSTEM POLICY FILTER
Last-Attempt-Date: Wed, 24 Oct 2018 20:32:15 GMT