Hi. DKIM is passing on this end, does this message pass DKIM? Authentication-Results: spf=pass (sender IP is 46.226.104.252) smtp.mailfrom=lists.hodgsonfamily.org; dkim=pass (signature was verified) header.d=lists.hodgsonfamily.org;dmarc=fail action=none header.from=gmail.com;compauth=fail reason=001 Thanks. Andrew. -----Original Message----- From: Jackie McBride <abletec@gmail.com> Sent: 15 November 2022 18:32 To: Mailing list for blind system administrators <blind-sysadmins@lists.hodgsonfamily.org> Subject: [Blind-sysadmins] Re: Test mail from new instance Other than the fact that it ended up in my spam folder because your DKIM is failing, it's good, ie, I got it. But yeah--you might wanna look to your DNS records just a bit, Andrew. I realize that's often the last thing on the list, so just a friendly reminder. On 11/15/22, Andrew Hodgson <andrew@hodgson.io> wrote:

Hi.

Testing mail from new larger VPS as I want to run a Mastodan instance from the same machine.

A few things may be off as the Mailman now uses a different backend so I can share stuff with the Mastadon instance.

Thanks. Andrew. _______________________________________________ Blind-sysadmins mailing list -- blind-sysadmins@lists.hodgsonfamily.org To unsubscribe send an email to blind-sysadmins-leave@lists.hodgsonfamily.org

-- Jackie McBride Be a hero. Fight Scams. Learn how at www.scam911.org Also check out brightstarsweb.com & mysitesbeenhacked.com _______________________________________________ Blind-sysadmins mailing list -- blind-sysadmins@lists.hodgsonfamily.org To unsubscribe send an email to blind-sysadmins-leave@lists.hodgsonfamily.org

On 21/11/22 01:57, Jackie McBride wrote:

It is now, Andrew. Maybe the dns hadn't propagated fully yet when you sent the first email. I'm sure you know how to do DMARC records, but, if you need help w/that, don't hesitate to hit me up.

I just checked the headers of your message (as quoted above), which include the results of my server's DKIM, SPF and DMARC verification. My server failed to find a DMARC record, hence couldn't complete the check. The DKIM signature check also failed (the hash didn't correspond to the message text). It may be necessary to set an option on the list server to ensure taht it doesn't invalidate DKIM signatures. I regret being the bearer of bad news. I know what it's like to be on the other side (having to fix the mail server's configuration).

Jackie McBride <abletec@gmail.com> wrote:

That's weird, Jason. When I asked GMail to show me the headers, I got, in part: SPF: PASS with IP 46.226.104.252 Learn more DKIM: 'PASS' with domain lists.hodgsonfamily.org

But you are correct that DMARC is not present.

Checking my own message as circulated via the list: Authentication-Results: svr.jasonjgw.net; dkim=pass header.d=lists.hodgsonfamily.org header.s=dkim header.b=f3esANwK; dkim=fail ("body hash did not verify") header.d=jasonjgw.net header.s=mail header.b=HmpYQIjv; spf=pass (svr.jasonjgw.net: domain of blind-sysadmins-bounces@lists.hodgsonfamily.org designates 2001:4b98:dc0:43:f816:3eff:fed7:3e66 as permitted sender) smtp.mailfrom=blind-sysadmins-bounces@lists.hodgsonfamily.org; dmarc=none I interpret this as desirable and correct, except for the missing DMARC policy. The list server seems to have added its own DKIM signature, invalidating the original signature.

I've added DMARC to the DNS now lets see how this goes. Andrew. -----Original Message----- From: Andrew Hodgson <andrew@hodgson.io> Sent: 21 November 2022 09:25 To: Mailing list for blind system administrators <blind-sysadmins@lists.hodgsonfamily.org> Subject: [Blind-sysadmins] Re: Test mail from new instance Hi. Mailman always modifies the message before it goes out so the original DKIM signature will be invalid. DMARC is a hot topic with list server software and I couldn't get a best practice answer on the best way of setting it up so it plays nicely with the way Mailman works. Andrew. -----Original Message----- From: Jason White via Blind-sysadmins <blind-sysadmins@lists.hodgsonfamily.org> Sent: 21 November 2022 05:19 To: blind-sysadmins@lists.hodgsonfamily.org Cc: Jason White <jason@jasonjgw.net> Subject: [Blind-sysadmins] Re: Test mail from new instance Jackie McBride <abletec@gmail.com> wrote:

That's weird, Jason. When I asked GMail to show me the headers, I got, in part: SPF: PASS with IP 46.226.104.252 Learn more DKIM: 'PASS' with domain lists.hodgsonfamily.org

But you are correct that DMARC is not present.

Checking my own message as circulated via the list: Authentication-Results: svr.jasonjgw.net; dkim=pass header.d=lists.hodgsonfamily.org header.s=dkim header.b=f3esANwK; dkim=fail ("body hash did not verify") header.d=jasonjgw.net header.s=mail header.b=HmpYQIjv; spf=pass (svr.jasonjgw.net: domain of blind-sysadmins-bounces@lists.hodgsonfamily.org designates 2001:4b98:dc0:43:f816:3eff:fed7:3e66 as permitted sender) smtp.mailfrom=blind-sysadmins-bounces@lists.hodgsonfamily.org; dmarc=none I interpret this as desirable and correct, except for the missing DMARC policy. The list server seems to have added its own DKIM signature, invalidating the original signature. _______________________________________________ Blind-sysadmins mailing list -- blind-sysadmins@lists.hodgsonfamily.org To unsubscribe send an email to blind-sysadmins-leave@lists.hodgsonfamily.org _______________________________________________ Blind-sysadmins mailing list -- blind-sysadmins@lists.hodgsonfamily.org To unsubscribe send an email to blind-sysadmins-leave@lists.hodgsonfamily.org