Jump to content
efa

support for DKIM-Signature

Recommended Posts

hi,

seems that the parsing engine fail with "DKIM-Signature", as it identify the included "Content-Type" as a stand alone header line, and so show "no links found" see:

https://www.spamcop.net/sc?id=z6503794799z62a7c6dcdb6ad9bf5c789fc564f35cb9z

Maybe spammer are adding fake DKIM-Signature to avoid Spamcop reporting of them links, Spamcop should skip this header line

 

Edited by efa

Share this post


Link to post
Share on other sites

The "no links found"

Quote
Finding links in message body

Ignored content-transfer-encoding:date:message-id part
no links found

is ref the body of the email not the header. 

Share this post


Link to post
Share on other sites

yes, the parser confuse the DKIM signature as a header line like:

Content-Type:Content-Transfer-Encoding

so the parsing of the body fail.

If you remove the DKIM signature in the header, the parse of the body end correctly.

This is probably a spammer technique to curcunvent Spamcop as I'm receiving many spam where body links are skipped like this one.

Spamcop please update the header parsing engine to support DKIM signature.

Edited by efa

Share this post


Link to post
Share on other sites
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=viverelavela.com; s=turbo-smtp; x=1544178043; h=DomainKey-Signature:
Received:Received:MIME-Version:From:Reply-To:To:Subject:
Content-Type:Content-Transfer-Encoding:Date:Message-ID; bh=K3Oe1
	kiUPrPyJIlOVf2MjQxxIABLTrz3/oGMMhm7Dfc=; b=Penr5h12pXZlZ4bS0rJDX

Hmmmm, I notice there is not a space or a tab in front of the received or content-type lines.  Per the RFCs that indicates it is not tied to the above, but is a new line.  Did those come that way in the original email, or is that from a line wrapping?

Share this post


Link to post
Share on other sites

the headers pasted in the form from the original email had the tabs:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=viverelavela.com; s=turbo-smtp; x=1544178043; h=DomainKey-Signature:
	Received:Received:MIME-Version:From:Reply-To:To:Subject:
	Content-Type:Content-Transfer-Encoding:Date:Message-ID; bh=K3Oe1
	kiUPrPyJIlOVf2MjQxxIABLTrz3/oGMMhm7Dfc=; b=Penr5h12pXZlZ4bS0rJDX
	OrHXneQnHej1GkJqeKVhBj3r8AbVL0mxtVpv6fOwwbwToAGLhYacs+g6HvgMYjRc
	uGom/zmkT7tSNevd591f5D5PVeq5Lfbvh8Qv0DDrf+xfYrEIu+P+o1rEcm/DXDBT
	RQYbAiMvI/1SuVBiadzNpcDomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
	s=turbo-smtp; d=viverelavela.com;
	h=Received:Received:X-TurboSMTP-Tracking:Return-Path:MIME-Version:From:Reply-To:To:Subject:Content-Type:Content-Transfer-Encoding:X-Mailer:Date:Message-ID:X-Antivirus:X-Antivirus-Status;
	b=KifANc9UKLW0O/8DvzmNyDM6DvkeULFid29JFOKgYTy8t2lqlXj1GEYT+aHas/
	cxKYfLb5ivaT79daL/G1xNF0R4mAqd6rbvjGBovTGNBgQ/K5J376fWADQTGIn+nO
	5dfgqbTLvT4WnvVnyVCXSKiqaO+0RPkMbacIUq2gfkyRE=;

but the headers shown by Spamcop after the parse became changed to:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=viverelavela.com; s=turbo-smtp; x=1544178043; h=DomainKey-Signature:
Received:Received:MIME-Version:From:Reply-To:To:Subject:
Content-Type:Content-Transfer-Encoding:Date:Message-ID; bh=K3Oe1
	kiUPrPyJIlOVf2MjQxxIABLTrz3/oGMMhm7Dfc=; b=Penr5h12pXZlZ4bS0rJDX
	OrHXneQnHej1GkJqeKVhBj3r8AbVL0mxtVpv6fOwwbwToAGLhYacs+g6HvgMYjRc
	uGom/zmkT7tSNevd591f5D5PVeq5Lfbvh8Qv0DDrf+xfYrEIu+P+o1rEcm/DXDBT
	RQYbAiMvI/1SuVBiadzNpcDomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
	s=turbo-smtp; d=viverelavela.com;
	h=Received:Received:X-TurboSMTP-Tracking:Return-Path:MIME-Version:From:Reply-To:To:Subject:Content-Type:Content-Transfer-Encoding:X-Mailer:Date:Message-ID:X-Antivirus:X-Antivirus-Status;
	b=KifANc9UKLW0O/8DvzmNyDM6DvkeULFid29JFOKgYTy8t2lqlXj1GEYT+aHas/
	cxKYfLb5ivaT79daL/G1xNF0R4mAqd6rbvjGBovTGNBgQ/K5J376fWADQTGIn+nO
	5dfgqbTLvT4WnvVnyVCXSKiqaO+0RPkMbacIUq2gfkyRE=;

 

Edited by efa

Share this post


Link to post
Share on other sites

DKIM signature is about a standard feature these days, is parsing engine still developed?

Share this post


Link to post
Share on other sites
1 hour ago, efa said:

is parsing engine still developed?

I believe it is still being developed.  I have occasional chat with the deputies where they are working with the developers.  I did run across this report that seems to have a DKIM in it and it seems to have parsed just fine.

https://www.spamcop.net/sc?id=z6505637534zf5ee6366a44d8e4afea7141b95ecf3a8z

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×