listserver problems?

[Nikola Lečić]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

On Thu, 18 Dec 2008 06:47:01 -0500
Michael Scheidell <scheidell at secnap.net> wrote:
 
> might be generic listserver issues, but I noticed that at least on 
> freebsd-jail list, it does NOT strip out dkim/domainkeys signatures.
> 
> that might not be to bad, but it does 'mung' the headers, so dkim
> signed email passed through freebsd mailing list server comes back as
> a forged signature.

Three objections to your DKIM signature:

(1)

Your canonicalization is "relaxed/simple", i.e. the mail is signed with
"simple" bodycanon:

  DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=secnap.net; h=

That's why you have

  Authentication-Results: [...] dkim=neutral (body hash did not verify)
    header.i=@secnap.net

- -- the list software appends some lines at the end of mail. You should
use 

  Canonicalization relaxed/relaxed

in dkim-filter.conf or

  milterdkim_flags="-c relaxed/relaxed"

in rc.conf if you use Sendmail. (See headers of my mail.)


(2)

You have "Received" header field included in the signature, while
RFC4871 states that it SHOULD NOT be the case:

  http://tools.ietf.org/html/rfc4871#section-5.5


(3)

You do not specify body length (l= in DKIM header). According to

  http://tools.ietf.org/html/rfc4871#section-3.4.5

it could be a good idea to use it, especially when mailing lists are in
question.


In total, mailing list owners don't have an obligation to strip DKIM
signatures. Instead, other methods can be used on both sides, see
section 4.1.

HTH
- -- 
Nikola Lečić = Никола Лечић
fingerprint : FEF3 66AF C90E EDC3 D878  7CDC 956D F4AB A377 1C9B
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (FreeBSD)

iJwEAQEDAAYFAklKV2MACgkQ/MM/0rYIoZhsnwQAowQy2nwd3IVYMtv9p7PVaoGZ
FQPpZZse/6PFi3KeegZcbOBFhOcNV3DzATt3z+VXdVYybajRXArj7WJtyEI2shGn
ssBmBdkD1bpoRzgf7jNYj6a9w8cVS/BC7gl07GBIhILEGLnpG8bjj7MtWhynj9SB
vn8jT/XF4QEKmDJSUwk=
=1fpm
-----END PGP SIGNATURE-----