Mailing List Archive: dkim-test valid but spamassassin scores DKIM

dkim-test valid but spamassassin scores DKIM_INVALID

Oct 24, 2023, 10:21 PM

Post #1 of 10 (343 views)

Hi,

I'm having here a mail that scores as DKIM_INVALID. I tried sending the same mail to gmail for example and it tells me that DKIM is valid. Now I put it through "spamassassin -D" and I am even more baffled because the debug seems to say that DKIM is valid but then scores as INVALID.
Any idea why this could be?

debug-output from "spamassassin -t -D dkim < message":

Oct 25 07:10:52.337 [1687666] dbg: dkim: using Mail::DKIM version 1.20200907
Oct 25 07:10:52.337 [1687666] dbg: dkim: providing our own resolver: Mail::SpamAssassin::DnsResolver
Oct 25 07:10:52.339 [1687666] dbg: dkim: performing public key lookup and signature verification
Oct 25 07:10:52.341 [1687666] dbg: dkim: VALID DKIM, i=@my.domain.com, d=my.domain.com, s=inx, a=rsa-sha256, c=relaxed/relaxed, key_bits=2048, pass, matches author domain
Oct 25 07:10:52.342 [1687666] dbg: dkim: signature verification result: PASS
Oct 25 07:10:52.342 [1687666] dbg: dkim: adsp not retrieved, author domain signature is valid
Oct 25 07:10:52.342 [1687666] dbg: dkim: adsp result: - (valid a. d. signature), author domain 'my.domain.com'
Oct 25 07:10:52.352 [1687666] dbg: dkim: VALID signature by my.domain.com, author me@my.domain.com, no valid matches
Oct 25 07:10:52.352 [1687666] dbg: dkim: author me@my.domain.com, not in any dkim whitelist
Oct 25 07:10:54.125 [1687779] info: util: setuid: ruid=0 euid=0 rgid=0 0 egid=0 0
Oct 25 07:10:54.277 [1687666] info: rules: meta test FROM_GOV_DKIM_AU has dependency 'DKIM_VALID_AU' with a zero score
Oct 25 07:10:54.281 [1687666] info: rules: meta test GOOG_REDIR_NORDNS has dependency 'RDNS_NONE' with a zero score
Oct 25 07:10:54.284 [1687666] info: rules: meta test KAM_CARD has dependency 'KAM_RPTR_SUSPECT' with a zero score
Oct 25 07:10:54.286 [1687666] info: rules: meta test __FORM_FRAUD has dependency 'EMRCP' with a zero score
Oct 25 07:10:54.286 [1687666] info: rules: meta test __FORM_FRAUD has dependency 'T_LOTTO_AGENT_FM' with a zero score
Oct 25 07:10:54.290 [1687666] info: rules: meta test KAM_DMARC_REJECT has dependency 'DKIM_VALID_AU' with a zero score
Oct 25 07:10:54.293 [1687666] info: rules: meta test FROM_GOV_REPLYTO_FREEMAIL has dependency 'DKIM_VALID_AU' with a zero score
Oct 25 07:10:54.303 [1687666] info: rules: meta test __MONEY_FRAUD_3 has dependency 'EMRCP' with a zero score
Oct 25 07:10:54.304 [1687666] info: rules: meta test __MONEY_FRAUD_3 has dependency 'T_LOTTO_AGENT_FM' with a zero score
Oct 25 07:10:54.306 [1687666] info: rules: meta test TO_NO_BRKTS_HTML_ONLY has dependency 'RDNS_NONE' with a zero score
Oct 25 07:10:54.308 [1687666] info: rules: meta test KAM_UAH_YAHOOGROUP_SENDER has dependency 'DKIM_VALID' with a zero score
Oct 25 07:10:54.310 [1687666] info: rules: meta test KAM_BAD_DNSWL has dependency 'URIBL_SBL' with a zero score
Oct 25 07:10:54.313 [1687666] info: rules: meta test KAM_SALE has dependency 'BODY_8BITS' with a zero score
Oct 25 07:10:54.314 [1687666] info: rules: meta test KAM_QUITE_BAD_DNSWL has dependency 'URIBL_SBL' with a zero score
Oct 25 07:10:54.316 [1687666] info: rules: meta test __MONEY_FRAUD_5 has dependency 'EMRCP' with a zero score
Oct 25 07:10:54.316 [1687666] info: rules: meta test __MONEY_FRAUD_5 has dependency 'T_LOTTO_AGENT_FM' with a zero score
Oct 25 07:10:54.320 [1687666] info: rules: meta test PDS_BRAND_SUBJ_NAKED_TO has dependency 'MAILING_LIST_MULTI' with a zero score
Oct 25 07:10:54.321 [1687666] info: rules: meta test FROM_BANK_NOAUTH has dependency 'DKIM_VALID_AU' with a zero score
Oct 25 07:10:54.322 [1687666] info: rules: meta test XPRIO has dependency 'DKIM_VALID' with a zero score
Oct 25 07:10:54.322 [1687666] info: rules: meta test XPRIO has dependency 'DKIM_VALID_AU' with a zero score
Oct 25 07:10:54.329 [1687666] info: rules: meta test __MONEY_FRAUD_8 has dependency 'EMRCP' with a zero score
Oct 25 07:10:54.329 [1687666] info: rules: meta test __MONEY_FRAUD_8 has dependency 'T_LOTTO_AGENT_FM' with a zero score
Oct 25 07:10:54.332 [1687666] info: rules: meta test KAM_PAYROLL_SCANNER has dependency 'KAM_IFRAME' with a zero score
Oct 25 07:10:54.333 [1687666] info: rules: meta test CONTENT_AFTER_HTML_WEAK has dependency 'MAILING_LIST_MULTI' with a zero score
Oct 25 07:10:54.335 [1687666] info: rules: meta test FORGED_MUA_EUDORA has dependency 'MAILING_LIST_MULTI' with a zero score
Oct 25 07:10:54.337 [1687666] info: rules: meta test OBFU_UNSUB_UL has dependency 'MAILING_LIST_MULTI' with a zero score
Oct 25 07:10:54.338 [1687666] info: rules: meta test KAM_BENEFICIARY2 has dependency 'GMD_PDF_EMPTY_BODY' with a zero score
Oct 25 07:10:54.338 [1687666] info: rules: meta test HAS_X_OUTGOING_SPAM_STAT has dependency 'MAILING_LIST_MULTI' with a zero score
Oct 25 07:10:54.341 [1687666] info: rules: meta test KAM_NOTIFY2 has dependency 'KAM_IFRAME' with a zero score
Oct 25 07:10:54.342 [1687666] info: rules: meta test KAM_DMARC_STATUS has dependency 'DKIM_VALID_AU' with a zero score
Oct 25 07:10:54.342 [1687666] info: rules: meta test KAM_DMARC_STATUS has dependency 'DKIM_VALID' with a zero score
Oct 25 07:10:54.343 [1687666] info: rules: meta test JMQ_CONGRAT has dependency 'KAM_RAPTOR_ALTERED' with a zero score
Oct 25 07:10:54.345 [1687666] info: rules: meta test __FORM_FRAUD_5 has dependency 'EMRCP' with a zero score
Oct 25 07:10:54.345 [1687666] info: rules: meta test __FORM_FRAUD_5 has dependency 'T_LOTTO_AGENT_FM' with a zero score
Oct 25 07:10:54.345 [1687666] info: rules: meta test KAM_FAKE_DELIVER has dependency 'KAM_RAPTOR_ALTERED' with a zero score
Oct 25 07:10:54.345 [1687666] info: rules: meta test KAM_JURY has dependency 'KAM_RAPTOR_ALTERED' with a zero score
Oct 25 07:10:54.346 [1687666] info: rules: meta test KAM_DMARC_NONE has dependency 'DKIM_VALID_AU' with a zero score
Oct 25 07:10:54.347 [1687666] info: rules: meta test T_GB_FROMNAME_SPOOFED_EMAIL_IP has dependency 'T_FROMNAME_SPOOFED_EMAIL' with a zero score
Oct 25 07:10:54.351 [1687666] info: rules: meta test __NOT_SPOOFED has dependency 'DKIM_VALID' with a zero score
Oct 25 07:10:54.353 [1687666] info: rules: meta test KAM_REALLY_FAKE_DELIVER has dependency 'KAM_RPTR_PASSED' with a zero score
Oct 25 07:10:54.356 [1687666] info: rules: meta test KAM_DMARC_QUARANTINE has dependency 'DKIM_VALID_AU' with a zero score
Oct 25 07:10:54.359 [1687666] info: rules: meta test INX_META_BL_3 has dependency 'INX_SUBJ_BL_220' with a zero score
Oct 25 07:10:54.360 [1687666] info: rules: meta test PDS_HP_HELO_NORDNS has dependency 'RDNS_NONE' with a zero score
Oct 25 07:10:54.360 [1687666] info: rules: meta test KAM_VISION has dependency 'RDNS_NONE' with a zero score
Oct 25 07:10:54.363 [1687666] info: rules: meta test KAM_FAKE_INVOICE has dependency 'KAM_RAPTOR_ALTERED' with a zero score
Oct 25 07:10:54.364 [1687666] info: rules: meta test DKIM_INVALID has dependency 'DKIM_VALID' with a zero score
Oct 25 07:10:54.365 [1687666] info: rules: meta test __TO_NO_BRKTS_NORDNS_HTML has dependency 'RDNS_NONE' with a zero score
Oct 25 07:10:54.366 [1687666] info: rules: meta test __FORM_FRAUD_3 has dependency 'EMRCP' with a zero score
Oct 25 07:10:54.366 [1687666] info: rules: meta test __FORM_FRAUD_3 has dependency 'T_LOTTO_AGENT_FM' with a zero score
Return-path: <me@my.domain.com>
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on one.ofmyhosts.com
X-Spam-Level: *
X-Spam-Status: No, score=1.6 required=5.0 tests=ALL_TRUSTED,DKIM_INVALID,
DKIM_SIGNED,KAM_DMARC_REJECT,KAM_DMARC_STATUS autolearn=disabled
version=3.4.6

Best,

Niels

Re: dkim-test valid but spamassassin scores DKIM_INVALID [ In reply to ]

uhlar at fantomas

Oct 24, 2023, 11:16 PM

Post #2 of 10 (343 views)

Permalink

On 25.10.23 07:21, Niels Kobsch?tzki wrote:
>I'm having here a mail that scores as DKIM_INVALID. I tried sending the
> same mail to gmail for example and it tells me that DKIM is valid. Now I
> put it through "spamassassin -D" and I am even more baffled because the
> debug seems to say that DKIM is valid but then scores as INVALID.

>Any idea why this could be?
>
>debug-output from "spamassassin -t -D dkim < message":
>
>Oct 25 07:10:52.341 [1687666] dbg: dkim: VALID DKIM, i=@my.domain.com, d=my.domain.com, s=inx, a=rsa-sha256, c=relaxed/relaxed, key_bits=2048, pass, matches author domain
>Oct 25 07:10:52.342 [1687666] dbg: dkim: signature verification result: PASS
>Oct 25 07:10:52.342 [1687666] dbg: dkim: adsp not retrieved, author domain signature is valid
>Oct 25 07:10:52.342 [1687666] dbg: dkim: adsp result: - (valid a. d. signature), author domain 'my.domain.com'
>Oct 25 07:10:52.352 [1687666] dbg: dkim: VALID signature by my.domain.com, author me@my.domain.com, no valid matches
>Oct 25 07:10:52.352 [1687666] dbg: dkim: author me@my.domain.com, not in any dkim whitelist
>Oct 25 07:10:54.125 [1687779] info: util: setuid: ruid=0 euid=0 rgid=0 0 egid=0 0

>Oct 25 07:10:54.364 [1687666] info: rules: meta test DKIM_INVALID has dependency 'DKIM_VALID' with a zero score

did you set score of DKIM_VALID do 0 ?

>Return-path: <me@my.domain.com>
>X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on one.ofmyhosts.com
>X-Spam-Level: *
>X-Spam-Status: No, score=1.6 required=5.0 tests=ALL_TRUSTED,DKIM_INVALID,
> DKIM_SIGNED,KAM_DMARC_REJECT,KAM_DMARC_STATUS autolearn=disabled
> version=3.4.6

--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
42.7 percent of all statistics are made up on the spot.

Re: dkim-test valid but spamassassin scores DKIM_INVALID [ In reply to ]

niels at kobschaetzki

Oct 24, 2023, 11:46 PM

Post #3 of 10 (343 views)

Permalink

> Matus UHLAR - fantomas <uhlar@fantomas.sk> hat am 25.10.2023 08:16 CEST geschrieben:
>
>
> On 25.10.23 07:21, Niels Kobschätzki wrote:
> >I'm having here a mail that scores as DKIM_INVALID. I tried sending the
> > same mail to gmail for example and it tells me that DKIM is valid. Now I
> > put it through "spamassassin -D" and I am even more baffled because the
> > debug seems to say that DKIM is valid but then scores as INVALID.
>
> >Any idea why this could be?
> >
> >debug-output from "spamassassin -t -D dkim < message":
> >
> >Oct 25 07:10:52.341 [1687666] dbg: dkim: VALID DKIM, i=@my.domain.com, d=my.domain.com, s=inx, a=rsa-sha256, c=relaxed/relaxed, key_bits=2048, pass, matches author domain
> >Oct 25 07:10:52.342 [1687666] dbg: dkim: signature verification result: PASS
> >Oct 25 07:10:52.342 [1687666] dbg: dkim: adsp not retrieved, author domain signature is valid
> >Oct 25 07:10:52.342 [1687666] dbg: dkim: adsp result: - (valid a. d. signature), author domain 'my.domain.com'
> >Oct 25 07:10:52.352 [1687666] dbg: dkim: VALID signature by my.domain.com, author me@my.domain.com, no valid matches
> >Oct 25 07:10:52.352 [1687666] dbg: dkim: author me@my.domain.com, not in any dkim whitelist
> >Oct 25 07:10:54.125 [1687779] info: util: setuid: ruid=0 euid=0 rgid=0 0 egid=0 0
>
> >Oct 25 07:10:54.364 [1687666] info: rules: meta test DKIM_INVALID has dependency 'DKIM_VALID' with a zero score
>
> did you set score of DKIM_VALID do 0 ?

DKIM_VALID is not overwritten by any of my local rules. So I would expect that this is the case. But even if I set for example

score DKIM_VALID 0
in local.cf there is no change

Best,

Niels

Re: dkim-test valid but spamassassin scores DKIM_INVALID [ In reply to ]

jdow at earthlink

Oct 25, 2023, 12:07 AM

Post #4 of 10 (343 views)

Permalink

On 20231024 23:46:18, Niels Kobschätzki wrote:
>> Matus UHLAR - fantomas<uhlar@fantomas.sk> hat am 25.10.2023 08:16 CEST geschrieben:
>>
>>
>> On 25.10.23 07:21, Niels Kobschätzki wrote:
>>> I'm having here a mail that scores as DKIM_INVALID. I tried sending the
>>> same mail to gmail for example and it tells me that DKIM is valid. Now I
>>> put it through "spamassassin -D" and I am even more baffled because the
>>> debug seems to say that DKIM is valid but then scores as INVALID.
>>> Any idea why this could be?
>>>
>>> debug-output from "spamassassin -t -D dkim < message":
>>>
>>> Oct 25 07:10:52.341 [1687666] dbg: dkim: VALID DKIM,i=@my.domain.com, d=my.domain.com, s=inx, a=rsa-sha256, c=relaxed/relaxed, key_bits=2048, pass, matches author domain
>>> Oct 25 07:10:52.342 [1687666] dbg: dkim: signature verification result: PASS
>>> Oct 25 07:10:52.342 [1687666] dbg: dkim: adsp not retrieved, author domain signature is valid
>>> Oct 25 07:10:52.342 [1687666] dbg: dkim: adsp result: - (valid a. d. signature), author domain 'my.domain.com'
>>> Oct 25 07:10:52.352 [1687666] dbg: dkim: VALID signature by my.domain.com, authorme@my.domain.com, no valid matches
>>> Oct 25 07:10:52.352 [1687666] dbg: dkim: authorme@my.domain.com, not in any dkim whitelist
>>> Oct 25 07:10:54.125 [1687779] info: util: setuid: ruid=0 euid=0 rgid=0 0 egid=0 0
>>> Oct 25 07:10:54.364 [1687666] info: rules: meta test DKIM_INVALID has dependency 'DKIM_VALID' with a zero score
>> did you set score of DKIM_VALID do 0 ?
> DKIM_VALID is not overwritten by any of my local rules. So I would expect that this is the case. But even if I set for example
>
> score DKIM_VALID 0
> in local.cf there is no change
>
> Best,
>
> Niels

Methinks you have here a very good clue to set a non-zero value, perhaps (most
likely), a modest negative score.

{o.o} Diving back into obscurity

Re: dkim-test valid but spamassassin scores DKIM_INVALID [ In reply to ]

uhlar at fantomas

Oct 25, 2023, 12:36 AM

Post #5 of 10 (343 views)

Permalink

>> On 25.10.23 07:21, Niels Kobsch?tzki wrote:
>> >I'm having here a mail that scores as DKIM_INVALID. I tried sending the
>> > same mail to gmail for example and it tells me that DKIM is valid. Now I
>> > put it through "spamassassin -D" and I am even more baffled because the
>> > debug seems to say that DKIM is valid but then scores as INVALID.
>>
>> >Any idea why this could be?
>> >
>> >debug-output from "spamassassin -t -D dkim < message":
>> >
>> >Oct 25 07:10:52.341 [1687666] dbg: dkim: VALID DKIM, i=@my.domain.com, d=my.domain.com, s=inx, a=rsa-sha256, c=relaxed/relaxed, key_bits=2048, pass, matches author domain
>> >Oct 25 07:10:52.342 [1687666] dbg: dkim: signature verification result: PASS
>> >Oct 25 07:10:52.342 [1687666] dbg: dkim: adsp not retrieved, author domain signature is valid
>> >Oct 25 07:10:52.342 [1687666] dbg: dkim: adsp result: - (valid a. d. signature), author domain 'my.domain.com'
>> >Oct 25 07:10:52.352 [1687666] dbg: dkim: VALID signature by my.domain.com, author me@my.domain.com, no valid matches
>> >Oct 25 07:10:52.352 [1687666] dbg: dkim: author me@my.domain.com, not in any dkim whitelist
>> >Oct 25 07:10:54.125 [1687779] info: util: setuid: ruid=0 euid=0 rgid=0 0 egid=0 0
>>
>> >Oct 25 07:10:54.364 [1687666] info: rules: meta test DKIM_INVALID has dependency 'DKIM_VALID' with a zero score

>> Matus UHLAR - fantomas <uhlar@fantomas.sk> hat am 25.10.2023 08:16 CEST geschrieben:
>> did you set score of DKIM_VALID do 0 ?

On 25.10.23 08:46, Niels Kobsch?tzki wrote:
>DKIM_VALID is not overwritten by any of my local rules. So I would expect that this is the case. But even if I set for example
>
>score DKIM_VALID 0
>in local.cf there is no change

I have:
50_scores.cf:score DKIM_VALID -0.1

check if you really haven't set score for DKIM_VALID anywhere, since SA
complains about it being zero.

I guess this may cause DKIM_INVALID misfiring
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
I drive way too fast to worry about cholesterol.

Re: dkim-test valid but spamassassin scores DKIM_INVALID [ In reply to ]

me at junc

Oct 25, 2023, 3:32 AM

Post #6 of 10 (343 views)

Permalink

Niels Kobschätzki skrev den 2023-10-25 08:46:

>> did you set score of DKIM_VALID do 0 ?
>
> DKIM_VALID is not overwritten by any of my local rules. So I would
> expect that this is the case. But even if I set for example
>
> score DKIM_VALID 0
> in local.cf there is no change

rules is loaded in sequence order, so 00_local is first while 99_local
is last, try add in last in same dir as local.cf

of that works, grep DKIM_VALID in all dirs with spamassassin rules, to
confirm where the stupid error is :=)

was it DKIM_INVALID ?

Re: dkim-test valid but spamassassin scores DKIM_INVALID [ In reply to ]

me at junc

Oct 25, 2023, 3:35 AM

Post #7 of 10 (343 views)

Permalink

jdow skrev den 2023-10-25 09:07:

> Methinks you have here a very good clue to set a non-zero value,
> perhaps (most likely), a modest negative score.

change of that score is a fail on its own

use welcomelist_from_dkim instaed

Re: dkim-test valid but spamassassin scores DKIM_INVALID [ In reply to ]

me at junc

Oct 25, 2023, 4:08 AM

Post #8 of 10 (343 views)

Permalink

Matus UHLAR - fantomas skrev den 2023-10-25 09:36:

> I have:
> 50_scores.cf:score DKIM_VALID -0.1
>
> check if you really haven't set score for DKIM_VALID anywhere, since SA
> complains about it being zero.
>
> I guess this may cause DKIM_INVALID misfiring

imho no, DKIM_INVALID have 0.1 in score, both should not be changed

its just a result tag, not a policy of any kind

Re: dkim-test valid but spamassassin scores DKIM_INVALID [ In reply to ]

uhlar at fantomas

Oct 25, 2023, 7:11 AM

Post #9 of 10 (343 views)

Permalink

>Matus UHLAR - fantomas skrev den 2023-10-25 09:36:
>>I have:
>>50_scores.cf:score DKIM_VALID -0.1
>>
>>check if you really haven't set score for DKIM_VALID anywhere, since
>>SA complains about it being zero.
>>
>>I guess this may cause DKIM_INVALID misfiring

On 25.10.23 13:08, Benny Pedersen wrote:
>imho no, DKIM_INVALID have 0.1 in score, both should not be changed
>
>its just a result tag, not a policy of any kind

This looks like OP has changed score of DKIM_VALID to 0:

> >Oct 25 07:10:54.364 [1687666] info: rules: meta test DKIM_INVALID has dependency 'DKIM_VALID' with a zero score

and since DKIM_INVALID depends on it:

meta DKIM_INVALID DKIM_SIGNED && !DKIM_VALID

...it would make sense DKIM_INVALID to hit whenever DKIM_SIGNED does
since DKIM_VALID apparently was made not to fire ever.

--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
I wonder how much deeper the ocean would be without sponges.

Re: dkim-test valid but spamassassin scores DKIM_INVALID [ In reply to ]

niels at kobschaetzki

Oct 25, 2023, 8:01 AM

Post #10 of 10 (343 views)

Permalink

> Matus UHLAR - fantomas <uhlar@fantomas.sk> hat am 25.10.2023 16:11 CEST geschrieben:
>
>
> >Matus UHLAR - fantomas skrev den 2023-10-25 09:36:
> >>I have:
> >>50_scores.cf:score DKIM_VALID -0.1
> >>
> >>check if you really haven't set score for DKIM_VALID anywhere, since
> >>SA complains about it being zero.
> >>
> >>I guess this may cause DKIM_INVALID misfiring
>
> On 25.10.23 13:08, Benny Pedersen wrote:
> >imho no, DKIM_INVALID have 0.1 in score, both should not be changed
> >
> >its just a result tag, not a policy of any kind
>
> This looks like OP has changed score of DKIM_VALID to 0:
>
> > >Oct 25 07:10:54.364 [1687666] info: rules: meta test DKIM_INVALID has dependency 'DKIM_VALID' with a zero score
>
> and since DKIM_INVALID depends on it:
>
> meta DKIM_INVALID DKIM_SIGNED && !DKIM_VALID
>
> ...it would make sense DKIM_INVALID to hit whenever DKIM_SIGNED does
> since DKIM_VALID apparently was made not to fire ever.

Thanks for your help everybody. After further inspection I found a file that must originated a long time ago. The problem with inherited systems.
I grepped only the files I usually modify (local.cf and some files that have a common file-name prefix for custom files) and in /var/lib/spamassassin

After greping more thoroughly I found the perpetrator.

Thanks a lot again,

Niels