Mailing List Archive

On Thu, Mar 07, 2024 at 01:38:15PM +0100, mhbeyle--- via Exim-users wrote:
> When a user groups several recipients under the To, Cc or Bcc fields, the
> message is encoded with a unique ID. Some relay providers impose limits on
> the number of such recipients.
> Is there any way to avoid this and is it possible, when faced with an
> envelope with more than one recipient (or a specific number of recipients),
> to configure a different ID for each of the messages being sent?
> I have been able to do some test with the max_rcpt parameter, but it does
> not work because the message ID remains the same.

Try to set max_rcpt=1 and modify Message-Id via transport script,
invoked by transport_filter option. Say, add nanoseconds to the left
side of msg-id, or substitute it with arbitrary generated msg-id.
--
Eugene Berdnikov

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

Tell your user they should use a proper mailing-list manager,
and follow best practices for bulk mail.

--
Cheers,
Jeremy


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

You are absolutely right and it would be ideal if everyone did the right
thing, but sometimes it is difficult to make users understand that it is
necessary to put a limit on the number of recipients. Especially if they
have been doing it this way for years.

There are other times when it is necessary to send information to a
large number of people through a mail client, using the Bcc field, and
you cannot install a mailing list manager just to cover the one or two
times that this happens.

It is to apply best practices that this is one of those occasions where
it is better to do things on the administration side than on the client
side. I don't know how to do it in a better way. ;-)


Regards,
Marie



El 08/03/2024 a las 11:44, Jeremy Harris via Exim-users escribió:
> Tell your user they should use a proper mailing-list manager,
> and follow best practices for bulk mail.
>


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On Fri, Mar 8, 2024 at 12:52?PM mhbeyle--- via Exim-users <
exim-users@lists.exim.org> wrote:

> You are absolutely right and it would be ideal if everyone did the right
> thing, but sometimes it is difficult to make users understand that it is
> necessary to put a limit on the number of recipients. Especially if they
> have been doing it this way for years.
>

I thought the issue at hand was that this user's way of doing it causes
problems for the deliverability of the user's messages?

Is it not reasonable to contact the user and say, look here, the way you
are sending email, it makes it hard to deliver your messages, here is how
you can improve your deliverability?

--
Jan

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

Believe me when I tell you that this has already been tried.
Sometimes you don't need to waste time on the impossible and just make
things work.

Regards,
Marie ..

El 08/03/2024 a las 13:09, Jan Ingvoldstad via Exim-users escribió:
> On Fri, Mar 8, 2024 at 12:52?PM mhbeyle--- via Exim-users <
> exim-users@lists.exim.org> wrote:
>
>> You are absolutely right and it would be ideal if everyone did the right
>> thing, but sometimes it is difficult to make users understand that it is
>> necessary to put a limit on the number of recipients. Especially if they
>> have been doing it this way for years.
>>
> I thought the issue at hand was that this user's way of doing it causes
> problems for the deliverability of the user's messages?
>
> Is it not reasonable to contact the user and say, look here, the way you
> are sending email, it makes it hard to deliver your messages, here is how
> you can improve your deliverability?
>


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On Fri, Mar 08, 2024 at 10:44:09AM +0000, Jeremy Harris via Exim-users wrote:
> Tell your user they should use a proper mailing-list manager,
> and follow best practices for bulk mail.

Probably user's answer would be: "Find proper mail provider.
Limit on number of messages with identical Message-id is ridiculous.
Message-Id and References fields MUST NOT be changed, because they
are used to build discussion threads, so each recipient should receive
exactly the same headers that are in original mail". Isn't it?
--
Eugene Berdnikov

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

Thanks for the point.

One more question: when using transport_filter,  Does the rest of the
message remain unchanged?,  Does the DKIM-Signature remain valid even if
the message ID has changed?

Regards,
Marie

El 08/03/2024 a las 9:50, Evgeniy Berdnikov via Exim-users escribió:
> On Thu, Mar 07, 2024 at 01:38:15PM +0100, mhbeyle--- via Exim-users wrote:
>> When a user groups several recipients under the To, Cc or Bcc fields, the
>> message is encoded with a unique ID. Some relay providers impose limits on
>> the number of such recipients.
>> Is there any way to avoid this and is it possible, when faced with an
>> envelope with more than one recipient (or a specific number of recipients),
>> to configure a different ID for each of the messages being sent?
>> I have been able to do some test with the max_rcpt parameter, but it does
>> not work because the message ID remains the same.
> Try to set max_rcpt=1 and modify Message-Id via transport script,
> invoked by transport_filter option. Say, add nanoseconds to the left
> side of msg-id, or substitute it with arbitrary generated msg-id.


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On 08/03/2024 19:55, mhbeyle--- via Exim-users wrote:
> when using transport_filter,  Does the rest of the message remain unchanged?,  Does the DKIM-Signature remain valid even if the message ID has changed?

DKIM signing is done after a transport filter.
--
Cheers,
Jeremy


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

D?a 8. marca 2024 20:12:08 UTC používate? Jeremy Harris via Exim-users <exim-users@lists.exim.org> napísal:

>DKIM signing is done after a transport filter.

Please, is that documented somewhere? I fail to find that,
and headers add/remove/rewrite in too.

I roughly remember from tests: "do not rewrite headers" in
signing transport, but i am not sure...

thanks


--
Slavko
https://www.slavino.sk/

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On 2024-03-09 Slavko via Exim-users <exim-users@lists.exim.org> wrote:
> D?a 8. marca 2024 20:12:08 UTC používate? Jeremy Harris via Exim-users <exim-users@lists.exim.org> napísal:

> >DKIM signing is done after a transport filter.

> Please, is that documented somewhere? I fail to find that,
> and headers add/remove/rewrite in too.

> I roughly remember from tests: "do not rewrite headers" in
> signing transport, but i am not sure...

The DKIM section of "DKIM, SPF, SRS and DMARC" starts with
| Exim’s DKIM implementation allows for
|
| 1. Signing outgoing messages: This function is implemented in the
| SMTP transport. It can co-exist with all other Exim features
| (including transport filters) except cutthrough delivery.

cu Andreas


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

D?a 9. marca 2024 7:15:17 UTC používate? Andreas Metzler via Exim-users <exim-users@lists.exim.org> napísal:

>The DKIM section of "DKIM, SPF, SRS and DMARC" starts with
>| Exim’s DKIM implementation allows for
>|
>| 1. Signing outgoing messages: This function is implemented in the
>| SMTP transport. It can co-exist with all other Exim features
>| (including transport filters) except cutthrough delivery.

Thanks, but i understand that, that dkim_* options can be used
together with any other transport's functions in mean of config
errors, but nothing about DKIM signature validity.

I recently play with this relative long time ago (IIRC in 4.92 or 4.94
versions), thus it can be changed from that time, but when i rewrite
From (and related) domain, and use domain:$h_from in dkim_domain,
it doesn't work.

I really do not remember what didn't work, if original domain was
selected (thus no DKIM key was found), or message was signed
with old headers, or both. But i guess, that it is related to:

header lines to be rewritten at transport time, that is, as the
message is being copied to its destination

Thus after DKIM was run...

In other words, IMO while i can use dkim_* & headers_rewrite together
in one transport, i cannot rely on new value in dkim_* expansion, nor
rewrite signed headers, otherwise the signature will be not valid.

I will appreciate, if someone who know (not guess as i) can confirm
or decline that.

regards


--
Slavko
https://www.slavino.sk/

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

On 09/03/2024 09:08, Slavko via Exim-users wrote:
> D?a 9. marca 2024 7:15:17 UTC používate? Andreas Metzler via Exim-users <exim-users@lists.exim.org> napísal:
>
>> The DKIM section of "DKIM, SPF, SRS and DMARC" starts with
>> | Exim’s DKIM implementation allows for
>> |
>> | 1. Signing outgoing messages: This function is implemented in the
>> | SMTP transport. It can co-exist with all other Exim features
>> | (including transport filters) except cutthrough delivery.
>
> Thanks, but i understand that, that dkim_* options can be used
> together with any other transport's functions in mean of config
> errors, but nothing about DKIM signature validity.
>
> I recently play with this relative long time ago (IIRC in 4.92 or 4.94
> versions), thus it can be changed from that time, but when i rewrite
> From (and related) domain, and use domain:$h_from in dkim_domain,
> it doesn't work.

That is because the "$h_from" is the value of the From: header of
the message as it arrived on the transport. The implementation does not expect
anyone to use a transport filter to rewrite headers; this could be
regarded as a deficiency.

However, the text of the headers (and body) of the message used as input
for the various hashes and signatures of the DKIM signing *is* the
output of any transport filter (this adds significant coding and cpu
overhead, as it happens). The documentation for this is the source-code,
for anybody caring that much.

Given that the transport already has facilities for headers manipulation
(the headers_rewrite, headers_remove and headers_add options)
I'd need some convincing that the deficiency identified must be addressed
by anything beyond documenting it.
These facilities are applied before any transport filter, and hence before
the dkim signing operation. I am reasonably sure that a rewrite will
be visible in $h_* expansion syntax used in dkim signing option.
However, the result of adds and removes will not be
(sigh. That should probably be fixed).

Whether this affects the OP or not depends on what headers they want
to sign vs. what they want to manipulate,

I'd also suggest (as a side issue) that not logging any such manipulation
(by any method) will make tracing delivery problems much more difficult.
--
Cheers,
Jeremy


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

D?a 9. marca 2024 15:38:43 UTC používate? Jeremy Harris via Exim-users <exim-users@lists.exim.org> napísal:

>However, the text of the headers (and body) of the message used as input
>for the various hashes and signatures of the DKIM signing *is* the
>output of any transport filter (this adds significant coding and cpu
>overhead, as it happens).

Thanks for explanation, i have to reread it to fuly understand it (my
English is not best), but to be clear, i don't use transport filter at all
(nor for header rewrite). For rewriting of headers i tried transport's
headers_rewrite option (to change/hide internal domain).

I was only interested in by your reply, that transport filter is applied
before DKIM happens, which was surprise for me...

regards


--
Slavko
https://www.slavino.sk/

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

Ahoj,

D?a Sat, 9 Mar 2024 15:38:43 +0000 Jeremy Harris via Exim-users
<exim-users@lists.exim.org> napísal:

> However, the text of the headers (and body) of the message used as
> input for the various hashes and signatures of the DKIM signing *is*
> the output of any transport filter (this adds significant coding and

I will leave transport_filter out, as i agree with you, that using
headers_rewrite is much better and straightforward for this.

> cpu overhead, as it happens). The documentation for this is the
> source-code, for anybody caring that much.

Reading of source code is not as easy for someone who don't speak C...

> These facilities are applied before any transport filter, and hence
> before the dkim signing operation. I am reasonably sure that a
> rewrite will be visible in $h_* expansion syntax used in dkim signing
> option. However, the result of adds and removes will not be
> (sigh. That should probably be fixed).

I did test which confirms my early tests (stock debian stable):

Exim version 4.96 #2 built 01-Jan-2024 16:58:00

I setup in transport (beside others):

headers_rewrite = *@mailt.internal $1@real frs
...
dkim_domain = ${acl{dkim_dom}}
dkim_private_key = ${acl{dkim_key}}
dkim_selector = default

I defined ACLs for that, to log values:

dkim_dom:
accept logwrite = DKIMrw: from_domain ${domain:$rh_from:}
message = ${domain:$rh_from:}

dkim_key:
accept logwrite = DKIMrw: dkim_domain $dkim_domain

And sending test message (via stdin) results in logs:

1rjGgs-000eYe-0U <= root@mailt.internal U=root P=local S=418
1rjGgs-000eYe-0U DKIMrw: from_domain mailt.internal
1rjGgs-000eYe-0U DKIMrw: dkim_domain mailt.internal
1rjGgs-000eYe-0U => my@real ...

I didn't setup key for this test, thus signing doesn't happen, but
from log one can see that from_domain & dkim_domain has value before
rewrite (received message has rewritten values).

regards

--
Slavko
https://www.slavino.sk

On 10/03/2024 11:29, Slavko via Exim-users wrote:
> from log one can see that from_domain & dkim_domain has value before
> rewrite (received message has rewritten values).

That matches my code-diving. You can't use (transport) header manipulation
results in the transport's dkim-control options (but the changed values
are what gets signed, if any such headers are included in the definition
for the signature).

I'll add this to the docs for now.
--
Cheers,
Jeremy


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

D?a 10. 3. o 14:31 Jeremy Harris via Exim-users napísal(a):

> That matches my code-diving.  You can't use (transport) header manipulation
> results in the transport's dkim-control options (but the changed values
> are what gets signed, if any such headers are included in the definition
> for the signature).

Finally i found time to do full tests and yes, the dkim_domain uses
original header values (in regard of transport headers modifications),
but message is signed with new header values.

In other words, when i do headers_rewrite (frs) in transport, i have to
setup the same "rewrite" for return_path and dkim_domain (if rewrote
headers are in play), after that all works as expected. It is little
more complicated than i expected, but it is possible to get it works.

But IMO, it is too complicated in DMARC world, where the best is to
match all, the return-path, h_from and dkim_domain (if appropriate).

> I'll add this to the docs for now.

Thanks, i noticed the related commit.

regards

--
Slavko
https://www.slavino.sk/


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/