Jump to content

support for DKIM-Signature


efa

Recommended Posts

hi,

seems that the parsing engine fail with "DKIM-Signature", as it identify the included "Content-Type" as a stand alone header line, and so show "no links found" see:

https://www.spamcop.net/sc?id=z6503794799z62a7c6dcdb6ad9bf5c789fc564f35cb9z

Maybe spammer are adding fake DKIM-Signature to avoid Spamcop reporting of them links, Spamcop should skip this header line

 

Link to comment
Share on other sites

yes, the parser confuse the DKIM signature as a header line like:

Content-Type:Content-Transfer-Encoding

so the parsing of the body fail.

If you remove the DKIM signature in the header, the parse of the body end correctly.

This is probably a spammer technique to curcunvent Spamcop as I'm receiving many spam where body links are skipped like this one.

Spamcop please update the header parsing engine to support DKIM signature.

Link to comment
Share on other sites

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=viverelavela.com; s=turbo-smtp; x=1544178043; h=DomainKey-Signature:
Received:Received:MIME-Version:From:Reply-To:To:Subject:
Content-Type:Content-Transfer-Encoding:Date:Message-ID; bh=K3Oe1
	kiUPrPyJIlOVf2MjQxxIABLTrz3/oGMMhm7Dfc=; b=Penr5h12pXZlZ4bS0rJDX

Hmmmm, I notice there is not a space or a tab in front of the received or content-type lines.  Per the RFCs that indicates it is not tied to the above, but is a new line.  Did those come that way in the original email, or is that from a line wrapping?

Link to comment
Share on other sites

the headers pasted in the form from the original email had the tabs:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=viverelavela.com; s=turbo-smtp; x=1544178043; h=DomainKey-Signature:
	Received:Received:MIME-Version:From:Reply-To:To:Subject:
	Content-Type:Content-Transfer-Encoding:Date:Message-ID; bh=K3Oe1
	kiUPrPyJIlOVf2MjQxxIABLTrz3/oGMMhm7Dfc=; b=Penr5h12pXZlZ4bS0rJDX
	OrHXneQnHej1GkJqeKVhBj3r8AbVL0mxtVpv6fOwwbwToAGLhYacs+g6HvgMYjRc
	uGom/zmkT7tSNevd591f5D5PVeq5Lfbvh8Qv0DDrf+xfYrEIu+P+o1rEcm/DXDBT
	RQYbAiMvI/1SuVBiadzNpcDomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
	s=turbo-smtp; d=viverelavela.com;
	h=Received:Received:X-TurboSMTP-Tracking:Return-Path:MIME-Version:From:Reply-To:To:Subject:Content-Type:Content-Transfer-Encoding:X-Mailer:Date:Message-ID:X-Antivirus:X-Antivirus-Status;
	b=KifANc9UKLW0O/8DvzmNyDM6DvkeULFid29JFOKgYTy8t2lqlXj1GEYT+aHas/
	cxKYfLb5ivaT79daL/G1xNF0R4mAqd6rbvjGBovTGNBgQ/K5J376fWADQTGIn+nO
	5dfgqbTLvT4WnvVnyVCXSKiqaO+0RPkMbacIUq2gfkyRE=;

but the headers shown by Spamcop after the parse became changed to:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=viverelavela.com; s=turbo-smtp; x=1544178043; h=DomainKey-Signature:
Received:Received:MIME-Version:From:Reply-To:To:Subject:
Content-Type:Content-Transfer-Encoding:Date:Message-ID; bh=K3Oe1
	kiUPrPyJIlOVf2MjQxxIABLTrz3/oGMMhm7Dfc=; b=Penr5h12pXZlZ4bS0rJDX
	OrHXneQnHej1GkJqeKVhBj3r8AbVL0mxtVpv6fOwwbwToAGLhYacs+g6HvgMYjRc
	uGom/zmkT7tSNevd591f5D5PVeq5Lfbvh8Qv0DDrf+xfYrEIu+P+o1rEcm/DXDBT
	RQYbAiMvI/1SuVBiadzNpcDomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
	s=turbo-smtp; d=viverelavela.com;
	h=Received:Received:X-TurboSMTP-Tracking:Return-Path:MIME-Version:From:Reply-To:To:Subject:Content-Type:Content-Transfer-Encoding:X-Mailer:Date:Message-ID:X-Antivirus:X-Antivirus-Status;
	b=KifANc9UKLW0O/8DvzmNyDM6DvkeULFid29JFOKgYTy8t2lqlXj1GEYT+aHas/
	cxKYfLb5ivaT79daL/G1xNF0R4mAqd6rbvjGBovTGNBgQ/K5J376fWADQTGIn+nO
	5dfgqbTLvT4WnvVnyVCXSKiqaO+0RPkMbacIUq2gfkyRE=;

 

Link to comment
Share on other sites

1 hour ago, efa said:

is parsing engine still developed?

I believe it is still being developed.  I have occasional chat with the deputies where they are working with the developers.  I did run across this report that seems to have a DKIM in it and it seems to have parsed just fine.

https://www.spamcop.net/sc?id=z6505637534zf5ee6366a44d8e4afea7141b95ecf3a8z

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...