support for DKIM-Signature

[efa]

hi,

seems that the parsing engine fail with "DKIM-Signature", as it identify the included "Content-Type" as a stand alone header line, and so show "no links found" see:

https://www.spamcop.net/sc?id=z6503794799z62a7c6dcdb6ad9bf5c789fc564f35cb9z

Maybe spammer are adding fake DKIM-Signature to avoid Spamcop reporting of them links, Spamcop should skip this header line

 

[Lking]

The "no links found"

Quote

Finding links in message body

Ignored content-transfer-encoding:date:message-id part
no links found

is ref the body of the email not the header. 

[efa]

yes, the parser confuse the DKIM signature as a header line like:

Content-Type:Content-Transfer-Encoding

so the parsing of the body fail.

If you remove the DKIM signature in the header, the parse of the body end correctly.

This is probably a spammer technique to curcunvent Spamcop as I'm receiving many spam where body links are skipped like this one.

Spamcop please update the header parsing engine to support DKIM signature.

[gnarlymarley]

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=viverelavela.com; s=turbo-smtp; x=1544178043; h=DomainKey-Signature:
Received:Received:MIME-Version:From:Reply-To:To:Subject:
Content-Type:Content-Transfer-Encoding:Date:Message-ID; bh=K3Oe1
	kiUPrPyJIlOVf2MjQxxIABLTrz3/oGMMhm7Dfc=; b=Penr5h12pXZlZ4bS0rJDX

Hmmmm, I notice there is not a space or a tab in front of the received or content-type lines.  Per the RFCs that indicates it is not tied to the above, but is a new line.  Did those come that way in the original email, or is that from a line wrapping?

[efa]

the headers pasted in the form from the original email had the tabs:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=viverelavela.com; s=turbo-smtp; x=1544178043; h=DomainKey-Signature:
	Received:Received:MIME-Version:From:Reply-To:To:Subject:
	Content-Type:Content-Transfer-Encoding:Date:Message-ID; bh=K3Oe1
	kiUPrPyJIlOVf2MjQxxIABLTrz3/oGMMhm7Dfc=; b=Penr5h12pXZlZ4bS0rJDX
	OrHXneQnHej1GkJqeKVhBj3r8AbVL0mxtVpv6fOwwbwToAGLhYacs+g6HvgMYjRc
	uGom/zmkT7tSNevd591f5D5PVeq5Lfbvh8Qv0DDrf+xfYrEIu+P+o1rEcm/DXDBT
	RQYbAiMvI/1SuVBiadzNpcDomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
	s=turbo-smtp; d=viverelavela.com;
	h=Received:Received:X-TurboSMTP-Tracking:Return-Path:MIME-Version:From:Reply-To:To:Subject:Content-Type:Content-Transfer-Encoding:X-Mailer:Date:Message-ID:X-Antivirus:X-Antivirus-Status;
	b=KifANc9UKLW0O/8DvzmNyDM6DvkeULFid29JFOKgYTy8t2lqlXj1GEYT+aHas/
	cxKYfLb5ivaT79daL/G1xNF0R4mAqd6rbvjGBovTGNBgQ/K5J376fWADQTGIn+nO
	5dfgqbTLvT4WnvVnyVCXSKiqaO+0RPkMbacIUq2gfkyRE=;

but the headers shown by Spamcop after the parse became changed to:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=viverelavela.com; s=turbo-smtp; x=1544178043; h=DomainKey-Signature:
Received:Received:MIME-Version:From:Reply-To:To:Subject:
Content-Type:Content-Transfer-Encoding:Date:Message-ID; bh=K3Oe1
	kiUPrPyJIlOVf2MjQxxIABLTrz3/oGMMhm7Dfc=; b=Penr5h12pXZlZ4bS0rJDX
	OrHXneQnHej1GkJqeKVhBj3r8AbVL0mxtVpv6fOwwbwToAGLhYacs+g6HvgMYjRc
	uGom/zmkT7tSNevd591f5D5PVeq5Lfbvh8Qv0DDrf+xfYrEIu+P+o1rEcm/DXDBT
	RQYbAiMvI/1SuVBiadzNpcDomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
	s=turbo-smtp; d=viverelavela.com;
	h=Received:Received:X-TurboSMTP-Tracking:Return-Path:MIME-Version:From:Reply-To:To:Subject:Content-Type:Content-Transfer-Encoding:X-Mailer:Date:Message-ID:X-Antivirus:X-Antivirus-Status;
	b=KifANc9UKLW0O/8DvzmNyDM6DvkeULFid29JFOKgYTy8t2lqlXj1GEYT+aHas/
	cxKYfLb5ivaT79daL/G1xNF0R4mAqd6rbvjGBovTGNBgQ/K5J376fWADQTGIn+nO
	5dfgqbTLvT4WnvVnyVCXSKiqaO+0RPkMbacIUq2gfkyRE=;

 

[efa]

DKIM signature is about a standard feature these days, is parsing engine still developed?

[gnarlymarley]

1 hour ago, efa said:

is parsing engine still developed?

I believe it is still being developed.  I have occasional chat with the deputies where they are working with the developers.  I did run across this report that seems to have a DKIM in it and it seems to have parsed just fine.

https://www.spamcop.net/sc?id=z6505637534zf5ee6366a44d8e4afea7141b95ecf3a8z

[efa]

in that case the parsing was correct, so apparently happen only sometimes