Hi,

I’m trying to figure out why, once again, outbound mail is not getting signed. We have again been blackholed by outlook.com and indeed, I noticed that DKIM signatures were missing.

In my case, I’m sending from a whitelisted IP (forwarding host) and the spam filter setting for that IP is active this time.

However, somehow rspamd seems to confuse inbound and outbound mail. Here, sending-domain.tld is the sender domain and hotmail.com would be the recipient domain.

rspamd-mailcow-1  | 2024-05-13 17:05:58 #42(normal) <264f80>; symcache; rspamd_symcache_item_async_dec_full: decrease async events counter for DKIM_CHECK(220) = 1 - 1; subsystem rspamd dkim plugin (./src/plugins/dkim_check.c:1285)
rspamd-mailcow-1  | 2024-05-13 17:05:58 #42(normal) <264f80>; dkim_signing; lua_dkim_tools.lua:195: mail is ineligible for signing
rspamd-mailcow-1  | 2024-05-13 17:05:59 #42(normal) <264f80>; dmarc; dmarc.lua:287: got DMARC record: v=DMARC1; p=quarantine; rua=mailto:dmarc@mydomain.tld; ruf=mailto:dmarc@mydomain.tld; adkim=r; aspf=r, tld_flag=false, processed={[p] = quarantine, [rua] = mailto:dmarc@mydomain.tld, [ruf] = mailto:dmarc@mydomain.tld, [aspf] = r, [adkim] = r}
rspamd-mailcow-1  | 2024-05-13 17:05:59 #42(normal) <264f80>; dmarc; dmarc.lua:376: validate DMARC policy (final=true): {[raw_elts] = {[p] = quarantine, [aspf] = r, [ruf] = mailto:dmarc@mydomain.tld, [rua] = mailto:dmarc@mydomain.tld, [adkim] = r}, [domain] = sending-domain.tld, [rua] = mailto:dmarc@mydomain.tld, [dmarc_policy] = quarantine}
rspamd-mailcow-1  | 2024-05-13 17:05:59 #42(normal) <264f80>; dmarc; dmarc.lua:182: validated dmarc policy for sending-domain.tld: quarantine; dkim_ok=false, dkim_tempfail=false, spf_ok=false, spf_tempfail=false
rspamd-mailcow-1  | 2024-05-13 17:05:59 #42(normal) <264f80>; arc; lua_dkim_tools.lua:193: mail was sent to us
rspamd-mailcow-1  | 2024-05-13 17:05:59 #42(normal) <264f80>; arc; lua_dkim_tools.lua:378: inbound: use domain(recipient) for signature: hotmail.com
rspamd-mailcow-1  | 2024-05-13 17:05:59 #42(normal) <264f80>; arc; lua_dkim_tools.lua:427: final DKIM domain: hotmail.com
rspamd-mailcow-1  | 2024-05-13 17:05:59 #42(normal) <264f80>; arc; lua_dkim_tools.lua:48: add selector "dkim" using default selector
rspamd-mailcow-1  | 2024-05-13 17:05:59 #42(normal) <264f80>; arc; lua_dkim_tools.lua:53: set domain to "hotmail.com" using dkim_domain
rspamd-mailcow-1  | 2024-05-13 17:05:59 #42(normal) <264f80>; lua; lua_dkim_tools.lua:590: using selector prefix 'DKIM_SELECTORS' for domain 'hotmail.com'
rspamd-mailcow-1  | 	dkim=none"

The code in lua_dkim_tools.lua that logs these two lines is this:

  if settings.sign_authenticated and auser then
    lua_util.debugm(N, task, 'user is authenticated')
    is_authed = true
  elseif (settings.sign_networks and settings.sign_networks:get_key(ip)) then
    is_sign_networks = true
    lua_util.debugm(N, task, 'mail is from address in sign_networks')
  elseif settings.sign_local and is_local then
    lua_util.debugm(N, task, 'mail is from local address')
  elseif settings.sign_inbound and not is_local and not auser then
    lua_util.debugm(N, task, 'mail was sent to us')
  else
    lua_util.debugm(N, task, 'mail is ineligible for signing')
    return false, {}
  end

And thus I’m also confused why both mail is ineligible for signing and mail was sent to us are logged, particularly in that specific order. Are we passing through rspamd twice?

I have no specific settings at all, nothing that would be relevant to rspamd as far as I can tell:

root@rspamd:/# curl http://nginx:8081/settings.php
settings {
  watchdog {
    priority = 10;
    rcpt_mime = "/null@localhost/i";
    from_mime = "/watchdog@localhost/i";
    apply "default" {
      symbols_disabled = ["HISTORY_SAVE", "ARC", "ARC_SIGNED", "DKIM", "DKIM_SIGNED", "CLAM_VIRUS"];
      want_spam = yes;
      actions {
        reject = 9999.0;
        greylist = 9998.0;
        "add header" = 9997.0;
      }

    }
  }
  ham_trap {
    rcpt = "/^ham[+].*@sending-domain.tld$/i";
    rcpt = "ham@sending-domain.tld";
    priority = 9;
    apply "default" {
      symbols_enabled = ["HISTORY_SAVE"];
    }
    symbols [
      "HAM_TRAP"
    ]
  }

  spam_trap {
    rcpt = "/^spam[+].*@sending-domain.tld$/i";
    rcpt = "spam@sending-domain.tld";
    priority = 9;
    apply "default" {
      symbols_enabled = ["HISTORY_SAVE"];
    }
    symbols [
      "SPAM_TRAP"
    ]
  }
  additional_settings_1 {
    task:set_milter_reply{
      add_headers = [
         From = me@anotherdomain.tld",
      ],
      remove_headers = [
        From = 0,
      ],
      change_from = "helpdesk@sending-domain.tld",
    }
  }
}

Since I’m not authenticating to send this mail, my guess is that the settings.sign_networks and settings.sign_networks:get_key(ip) condition will have to match instead for that mail to be signed.

I can’t say I understand why that is now necessary, I seriously think this used to work just fine before.

So, this is where sign_networks is defined:

./data/conf/rspamd/local.d/dkim_signing.conf:sign_networks = "/etc/rspamd/custom/dovecot_trusted.map";

I couldn’t find any documentation on how to customize this… so I wanted to modify dovecot_trusted.map…

root@rspamd:/# cat /etc/rspamd/custom/dovecot_trusted.map
172.22.1.250/32
fd4d:6169:6c63:6f77::c/128

but that file gets overwritten, at least whenever the rspamd container is restarted.