Jump to content

support for DKIM-Signature


efa

Recommended Posts

hi,

seems that the parsing engine fail with "DKIM-Signature", as it identify the included "Content-Type" as a stand alone header line, and so show "no links found" see:

https://www.spamcop.net/sc?id=z6503794799z62a7c6dcdb6ad9bf5c789fc564f35cb9z

Maybe spammer are adding fake DKIM-Signature to avoid Spamcop reporting of them links, Spamcop should skip this header line

 

Edited by efa
Link to comment
Share on other sites

yes, the parser confuse the DKIM signature as a header line like:

Content-Type:Content-Transfer-Encoding

so the parsing of the body fail.

If you remove the DKIM signature in the header, the parse of the body end correctly.

This is probably a spammer technique to curcunvent Spamcop as I'm receiving many spam where body links are skipped like this one.

Spamcop please update the header parsing engine to support DKIM signature.

Edited by efa
Link to comment
Share on other sites

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=viverelavela.com; s=turbo-smtp; x=1544178043; h=DomainKey-Signature:
Received:Received:MIME-Version:From:Reply-To:To:Subject:
Content-Type:Content-Transfer-Encoding:Date:Message-ID; bh=K3Oe1
	kiUPrPyJIlOVf2MjQxxIABLTrz3/oGMMhm7Dfc=; b=Penr5h12pXZlZ4bS0rJDX

Hmmmm, I notice there is not a space or a tab in front of the received or content-type lines.  Per the RFCs that indicates it is not tied to the above, but is a new line.  Did those come that way in the original email, or is that from a line wrapping?

Link to comment
Share on other sites

the headers pasted in the form from the original email had the tabs:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=viverelavela.com; s=turbo-smtp; x=1544178043; h=DomainKey-Signature:
	Received:Received:MIME-Version:From:Reply-To:To:Subject:
	Content-Type:Content-Transfer-Encoding:Date:Message-ID; bh=K3Oe1
	kiUPrPyJIlOVf2MjQxxIABLTrz3/oGMMhm7Dfc=; b=Penr5h12pXZlZ4bS0rJDX
	OrHXneQnHej1GkJqeKVhBj3r8AbVL0mxtVpv6fOwwbwToAGLhYacs+g6HvgMYjRc
	uGom/zmkT7tSNevd591f5D5PVeq5Lfbvh8Qv0DDrf+xfYrEIu+P+o1rEcm/DXDBT
	RQYbAiMvI/1SuVBiadzNpcDomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
	s=turbo-smtp; d=viverelavela.com;
	h=Received:Received:X-TurboSMTP-Tracking:Return-Path:MIME-Version:From:Reply-To:To:Subject:Content-Type:Content-Transfer-Encoding:X-Mailer:Date:Message-ID:X-Antivirus:X-Antivirus-Status;
	b=KifANc9UKLW0O/8DvzmNyDM6DvkeULFid29JFOKgYTy8t2lqlXj1GEYT+aHas/
	cxKYfLb5ivaT79daL/G1xNF0R4mAqd6rbvjGBovTGNBgQ/K5J376fWADQTGIn+nO
	5dfgqbTLvT4WnvVnyVCXSKiqaO+0RPkMbacIUq2gfkyRE=;

but the headers shown by Spamcop after the parse became changed to:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=viverelavela.com; s=turbo-smtp; x=1544178043; h=DomainKey-Signature:
Received:Received:MIME-Version:From:Reply-To:To:Subject:
Content-Type:Content-Transfer-Encoding:Date:Message-ID; bh=K3Oe1
	kiUPrPyJIlOVf2MjQxxIABLTrz3/oGMMhm7Dfc=; b=Penr5h12pXZlZ4bS0rJDX
	OrHXneQnHej1GkJqeKVhBj3r8AbVL0mxtVpv6fOwwbwToAGLhYacs+g6HvgMYjRc
	uGom/zmkT7tSNevd591f5D5PVeq5Lfbvh8Qv0DDrf+xfYrEIu+P+o1rEcm/DXDBT
	RQYbAiMvI/1SuVBiadzNpcDomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
	s=turbo-smtp; d=viverelavela.com;
	h=Received:Received:X-TurboSMTP-Tracking:Return-Path:MIME-Version:From:Reply-To:To:Subject:Content-Type:Content-Transfer-Encoding:X-Mailer:Date:Message-ID:X-Antivirus:X-Antivirus-Status;
	b=KifANc9UKLW0O/8DvzmNyDM6DvkeULFid29JFOKgYTy8t2lqlXj1GEYT+aHas/
	cxKYfLb5ivaT79daL/G1xNF0R4mAqd6rbvjGBovTGNBgQ/K5J376fWADQTGIn+nO
	5dfgqbTLvT4WnvVnyVCXSKiqaO+0RPkMbacIUq2gfkyRE=;

 

Edited by efa
Link to comment
Share on other sites

1 hour ago, efa said:

is parsing engine still developed?

I believe it is still being developed.  I have occasional chat with the deputies where they are working with the developers.  I did run across this report that seems to have a DKIM in it and it seems to have parsed just fine.

https://www.spamcop.net/sc?id=z6505637534zf5ee6366a44d8e4afea7141b95ecf3a8z

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...