efa Posted November 30, 2018 Posted November 30, 2018 hi, seems that the parsing engine fail with "DKIM-Signature", as it identify the included "Content-Type" as a stand alone header line, and so show "no links found" see: https://www.spamcop.net/sc?id=z6503794799z62a7c6dcdb6ad9bf5c789fc564f35cb9z Maybe spammer are adding fake DKIM-Signature to avoid Spamcop reporting of them links, Spamcop should skip this header line
Lking Posted November 30, 2018 Posted November 30, 2018 The "no links found" Quote Finding links in message body Ignored content-transfer-encoding:date:message-id part no links found is ref the body of the email not the header.
efa Posted December 4, 2018 Author Posted December 4, 2018 yes, the parser confuse the DKIM signature as a header line like: Content-Type:Content-Transfer-Encoding so the parsing of the body fail. If you remove the DKIM signature in the header, the parse of the body end correctly. This is probably a spammer technique to curcunvent Spamcop as I'm receiving many spam where body links are skipped like this one. Spamcop please update the header parsing engine to support DKIM signature.
gnarlymarley Posted December 4, 2018 Posted December 4, 2018 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=viverelavela.com; s=turbo-smtp; x=1544178043; h=DomainKey-Signature: Received:Received:MIME-Version:From:Reply-To:To:Subject: Content-Type:Content-Transfer-Encoding:Date:Message-ID; bh=K3Oe1 kiUPrPyJIlOVf2MjQxxIABLTrz3/oGMMhm7Dfc=; b=Penr5h12pXZlZ4bS0rJDX Hmmmm, I notice there is not a space or a tab in front of the received or content-type lines. Per the RFCs that indicates it is not tied to the above, but is a new line. Did those come that way in the original email, or is that from a line wrapping?
efa Posted December 4, 2018 Author Posted December 4, 2018 the headers pasted in the form from the original email had the tabs: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=viverelavela.com; s=turbo-smtp; x=1544178043; h=DomainKey-Signature: Received:Received:MIME-Version:From:Reply-To:To:Subject: Content-Type:Content-Transfer-Encoding:Date:Message-ID; bh=K3Oe1 kiUPrPyJIlOVf2MjQxxIABLTrz3/oGMMhm7Dfc=; b=Penr5h12pXZlZ4bS0rJDX OrHXneQnHej1GkJqeKVhBj3r8AbVL0mxtVpv6fOwwbwToAGLhYacs+g6HvgMYjRc uGom/zmkT7tSNevd591f5D5PVeq5Lfbvh8Qv0DDrf+xfYrEIu+P+o1rEcm/DXDBT RQYbAiMvI/1SuVBiadzNpcDomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=turbo-smtp; d=viverelavela.com; h=Received:Received:X-TurboSMTP-Tracking:Return-Path:MIME-Version:From:Reply-To:To:Subject:Content-Type:Content-Transfer-Encoding:X-Mailer:Date:Message-ID:X-Antivirus:X-Antivirus-Status; b=KifANc9UKLW0O/8DvzmNyDM6DvkeULFid29JFOKgYTy8t2lqlXj1GEYT+aHas/ cxKYfLb5ivaT79daL/G1xNF0R4mAqd6rbvjGBovTGNBgQ/K5J376fWADQTGIn+nO 5dfgqbTLvT4WnvVnyVCXSKiqaO+0RPkMbacIUq2gfkyRE=; but the headers shown by Spamcop after the parse became changed to: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=viverelavela.com; s=turbo-smtp; x=1544178043; h=DomainKey-Signature: Received:Received:MIME-Version:From:Reply-To:To:Subject: Content-Type:Content-Transfer-Encoding:Date:Message-ID; bh=K3Oe1 kiUPrPyJIlOVf2MjQxxIABLTrz3/oGMMhm7Dfc=; b=Penr5h12pXZlZ4bS0rJDX OrHXneQnHej1GkJqeKVhBj3r8AbVL0mxtVpv6fOwwbwToAGLhYacs+g6HvgMYjRc uGom/zmkT7tSNevd591f5D5PVeq5Lfbvh8Qv0DDrf+xfYrEIu+P+o1rEcm/DXDBT RQYbAiMvI/1SuVBiadzNpcDomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=turbo-smtp; d=viverelavela.com; h=Received:Received:X-TurboSMTP-Tracking:Return-Path:MIME-Version:From:Reply-To:To:Subject:Content-Type:Content-Transfer-Encoding:X-Mailer:Date:Message-ID:X-Antivirus:X-Antivirus-Status; b=KifANc9UKLW0O/8DvzmNyDM6DvkeULFid29JFOKgYTy8t2lqlXj1GEYT+aHas/ cxKYfLb5ivaT79daL/G1xNF0R4mAqd6rbvjGBovTGNBgQ/K5J376fWADQTGIn+nO 5dfgqbTLvT4WnvVnyVCXSKiqaO+0RPkMbacIUq2gfkyRE=;
efa Posted December 11, 2018 Author Posted December 11, 2018 DKIM signature is about a standard feature these days, is parsing engine still developed?
gnarlymarley Posted December 11, 2018 Posted December 11, 2018 1 hour ago, efa said: is parsing engine still developed? I believe it is still being developed. I have occasional chat with the deputies where they are working with the developers. I did run across this report that seems to have a DKIM in it and it seems to have parsed just fine. https://www.spamcop.net/sc?id=z6505637534zf5ee6366a44d8e4afea7141b95ecf3a8z
efa Posted December 13, 2018 Author Posted December 13, 2018 in that case the parsing was correct, so apparently happen only sometimes
Recommended Posts
Archived
This topic is now archived and is closed to further replies.