On Fri, Mar 4, 2022 at 12:47 PM Baptiste Beauplat <lyknode@cilg.org> wrote:
My debian address is also affected, and probably others that did not
setup DKIM for their @debian.org address.
As a reminder debian.org addresses does support DKIM. After
configuration on your mail server, you can publish your DKIM public key
to db.debian.org [1][2].
Can you point to some quick guide on how to do this for gmail? The
support page seems kinda confusing to me.
My debian address is also affected, and probably others that did not
setup DKIM for their @debian.org address.
As a reminder debian.org addresses does support DKIM. After
configuration on your mail server, you can publish your DKIM public key
to db.debian.org [1][2].
On Fri, Mar 4, 2022 at 12:47 PM Baptiste Beauplat <lyknode@cilg.org>
wrote:
As a reminder debian.org addresses does support DKIM. After
configuration on your mail server, you can publish your DKIM public
key
to db.debian.org [1][2].
Can you point to some quick guide on how to do this for gmail? The
support page seems kinda confusing to me.
We recently discovered that Gmail started to bounce email from mentors.debian.net with the following message:
On Fri, Mar 04, 2022 at 12:38:02PM +0100, Baptiste Beauplat wrote:
We recently discovered that Gmail started to bounce email from
mentors.debian.net with the following message:
Can you please share the complete headers of the bounced message? Aka
the thing in the message/rfc822 part of the DSN message. Right now we
don't know what they see from your explanation.
On 3/4/22 14:40, Bastian Blank wrote:
On Fri, Mar 04, 2022 at 12:38:02PM +0100, Baptiste Beauplat wrote:
We recently discovered that Gmail started to bounce email from
mentors.debian.net with the following message:
Can you please share the complete headers of the bounced message? Aka
the thing in the message/rfc822 part of the DSN message. Right now we don't know what they see from your explanation.
I'm attached the bounce.
Am I mistaken in thinking that's only a case of simply rejecting
unsigned DKIM email?
Am I mistaken in thinking that's only a case of simply rejecting
unsigned DKIM email?
Return-Path: <expo+bounce@mentors.debian.net>
Received: from mentors.debian.net (localhost [127.0.0.1])
by wv-debian-mentors1.wavecloud.de (Postfix) with ESMTP id 55D16823EC
for <**********@gmail.com>; Fri, 4 Mar 2022 03:14:03 +0000 (UTC) Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: Next step: Confirm your email address
From: mentors.debian.net <support@mentors.debian.net>
To: **********@gmail.com
Date: Fri, 04 Mar 2022 03:14:03 -0000
Message-ID: <164636364329.4074035.11224505717463252630@mentors.debian.net>
mentors.debian.net with the following message:Can you please share the complete headers of the bounced message? Aka
the thing in the message/rfc822 part of the DSN message. Right now we don't know what they see from your explanation.
I'm attached the bounce.
Am I mistaken in thinking that's only a case of simply rejecting
unsigned DKIM email?
Google uses a number of criteria when blocking. A missing DKIM is just one. See the referenced document:
https://support.google.com/mail/answer/81126
One of the problems here is that mentors.debian.net does not have the standard
email security DNS records - SPF, DKIM, DMARC, MTA-TLS, DANE. This doesn't automatically cause Google to classify as spam but we really should have these
in place to protect email.
As an example, we may be spoofing mentors.debian.net with wv-debian- mentors1.wavecloud.de (not 100% clear with the headers provided). SPF could handle this.
I reproduced a similar problem, then set up DKIM for myself and
everything then worked, so I think you're correct.
The links in the original d-d-a email were mostly stale, but I found https://bynicolas.com/server/exim-multi-domain-dkim-custom-selector/
helpful in getting this going with my local Exim setup.
However for SPF, if I'm not mistaken, this is not possible for
@debian.org addresses since Debian does not offers an MSA and
therefor not a single (or enumerable list of) exit point.
On 3/4/22 15:41, LeJacq, Jean Pierre wrote:
Google uses a number of criteria when blocking. A missing DKIM is just
one.
See the referenced document:
https://support.google.com/mail/answer/81126
One of the problems here is that mentors.debian.net does not have the standard email security DNS records - SPF, DKIM, DMARC, MTA-TLS, DANE. This doesn't automatically cause Google to classify as spam but we really should have these in place to protect email.
As an example, we may be spoofing mentors.debian.net with wv-debian- mentors1.wavecloud.de (not 100% clear with the headers provided). SPF
could
handle this.
Indeed we are looking into it for mentors.
However for SPF, if I'm not mistaken, this is not possible for
@debian.org addresses since Debian does not offers an MSA and therefor
not a single (or enumerable list of) exit point.
On Fri, 2022-03-04 at 14:36:01 +0000, Colin Watson wrote:[...]
I reproduced a similar problem, then set up DKIM for myself and
everything then worked, so I think you're correct.
The links in the original d-d-a email were mostly stale, but I found https://bynicolas.com/server/exim-multi-domain-dkim-custom-selector/ helpful in getting this going with my local Exim setup.
You might want to also fix the DKIM_SIGN_HEADERS macro in the Exim
config, as its default is currently broken (see #939808). The patch
attached there is not helpful for local usage, so you might want
something like what I've got in my config:
On Fri, 2022-03-04 at 15:45 +0100, Baptiste Beauplat wrote:
However for SPF, if I'm not mistaken, this is not possible for
@debian.org addresses since Debian does not offers an MSA and
therefor not a single (or enumerable list of) exit point.
Using SPF would be possible. Gentoo does that:
gentoo.org. IN TXT "v=spf1 [...] include:%{l}.%{o}.spf.gentoo.org ?all"
and their users can then add SPF entries for individual localparts.
But either way is quite complicated for "just" using a mail address for outgoing mail.
Also some infrastructure in Debian will break DKIM signatures. For
example, bugs.debian.org (always) and lists.debian.org (sometimes, for example when List-* header fields are part of the DKIM signature). So
one can't rely on valid SPF/DKIM anyway and, as far as I understand,
rely on debian.org infrastructure being on providers' whitelists
instead (as it "impersonates" other domains in mail sender addresses).
There are standard best practices for forwarding support in SPF.
http://www.open-spf.org/Best_Practices/Forwarding/
Looking at your email headers, I would guess that gmail is already doing it.No irony, you are just missing the point.
X-Google-DKIM-Signature: v=1; a=rsa-sha256...
There is somewhat some irony in Gmail blocking email without a DKIM
signature while they are using a non-standard header that other provider/tools might miss. Just a thought.
On Fri, 2022-03-04 at 10:21 -0500, LeJacq, Jean Pierre wrote:
There are standard best practices for forwarding support in SPF.
http://www.open-spf.org/Best_Practices/Forwarding/
Having each individual user have to configure forwarders (i.e., per-
user whitelists), including services like mailing lists, our bug
tracker and so on, seems impractical. I also doubt many mail providers
allow user to do so.
And SRS also relies on whitelists again (otherwise it just allows
bypassing any SPF policy).
Can you point to some quick guide on how to do this for gmail? The
support page seems kinda confusing to me.
This usually requires you running your own mail server (for outgoing
mail).
I don't think mail providers like GMail allow you to set up DKIM for individual IP addresses.
On Mar 04, Baptiste Beauplat <lyknode@cilg.org> wrote:
Looking at your email headers, I would guess that gmail is already doing it. >>
X-Google-DKIM-Signature: v=1; a=rsa-sha256...
There is somewhat some irony in Gmail blocking email without a DKIM
signature while they are using a non-standard header that other
provider/tools might miss. Just a thought.
No irony, you are just missing the point.
gmail uses this X header for internal purposes, and there is no DKIM signature because the message has a @debian.org 822.from address hence
gmail obviously lacks a valid key for it.
We recently discovered that Gmail started to bounce email from >mentors.debian.net with the following message:
550-5.7.26 This message does not have authentication information or
fails to 550-5.7.26 pass authentication
checks. To best protect our users from spam, the 550-5.7.26 message has
been blocked. Please visit 550-5.7.26 >https://support.google.com/mail/answer/81126#authentication for more 5
50 5.7.26 information.
On Fri, 2022-03-04 at 13:27 +0100, Stephan Lachnit wrote:
On Fri, Mar 4, 2022 at 12:47 PM Baptiste Beauplat <lyknode@cilg.org>
wrote:
As a reminder debian.org addresses does support DKIM. After
configuration on your mail server, you can publish your DKIM public
key
to db.debian.org [1][2].
Can you point to some quick guide on how to do this for gmail? The
support page seems kinda confusing to me.
This usually requires you running your own mail server (for outgoing
mail).
I don't think mail providers like GMail allow you to set up DKIM for individual IP addresses.
</div><div><br></div><div>Last of all, to send emails within Gmail using <a href="mailto:csmall@debian.org" target="_blank">csmall@debian.org</a> as my from address, you go into Settings->Accounts->Send mail as. The outbound mailserver is myserver (that signs my debian emails). Of course my outbound server requires a username and password to send emails so that is recorded in the settings too (and is unique for each sending system/server).</div><div><br></div><div>The result is this
There are standard best practices for forwarding support in SPF.
http://www.open-spf.org/Best_Practices/Forwarding/
Sysop: | Keyop |
---|---|
Location: | Huddersfield, West Yorkshire, UK |
Users: | 339 |
Nodes: | 16 (2 / 14) |
Uptime: | 00:17:00 |
Calls: | 7,466 |
Calls today: | 2 |
Files: | 12,691 |
Messages: | 5,627,864 |