support for DKIM-Signature

[efa 0]

hi,

seems that the parsing engine fail with "DKIM-Signature", as it identify the included "Content-Type" as a stand alone header line, and so show "no links found" see:

https://www.spamcop.net/sc?id=z6503794799z62a7c6dcdb6ad9bf5c789fc564f35cb9z

Maybe spammer are adding fake DKIM-Signature to avoid Spamcop reporting of them links, Spamcop should skip this header line

 

Edited November 30, 2018 by efa

[Lking 0]

The "no links found"

Quote

Finding links in message body

Ignored content-transfer-encoding:date:message-id part
no links found

is ref the body of the email not the header. 

[efa 0]

yes, the parser confuse the DKIM signature as a header line like:

Content-Type:Content-Transfer-Encoding

so the parsing of the body fail.

If you remove the DKIM signature in the header, the parse of the body end correctly.

This is probably a spammer technique to curcunvent Spamcop as I'm receiving many spam where body links are skipped like this one.

Spamcop please update the header parsing engine to support DKIM signature.

Edited December 4, 2018 by efa

[gnarlymarley 0]

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=viverelavela.com; s=turbo-smtp; x=1544178043; h=DomainKey-Signature:
Received:Received:MIME-Version:From:Reply-To:To:Subject:
Content-Type:Content-Transfer-Encoding:Date:Message-ID; bh=K3Oe1
	kiUPrPyJIlOVf2MjQxxIABLTrz3/oGMMhm7Dfc=; b=Penr5h12pXZlZ4bS0rJDX

Hmmmm, I notice there is not a space or a tab in front of the received or content-type lines.  Per the RFCs that indicates it is not tied to the above, but is a new line.  Did those come that way in the original email, or is that from a line wrapping?

[efa 0]

the headers pasted in the form from the original email had the tabs:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=viverelavela.com; s=turbo-smtp; x=1544178043; h=DomainKey-Signature:
	Received:Received:MIME-Version:From:Reply-To:To:Subject:
	Content-Type:Content-Transfer-Encoding:Date:Message-ID; bh=K3Oe1
	kiUPrPyJIlOVf2MjQxxIABLTrz3/oGMMhm7Dfc=; b=Penr5h12pXZlZ4bS0rJDX
	OrHXneQnHej1GkJqeKVhBj3r8AbVL0mxtVpv6fOwwbwToAGLhYacs+g6HvgMYjRc
	uGom/zmkT7tSNevd591f5D5PVeq5Lfbvh8Qv0DDrf+xfYrEIu+P+o1rEcm/DXDBT
	RQYbAiMvI/1SuVBiadzNpcDomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
	s=turbo-smtp; d=viverelavela.com;
	h=Received:Received:X-TurboSMTP-Tracking:Return-Path:MIME-Version:From:Reply-To:To:Subject:Content-Type:Content-Transfer-Encoding:X-Mailer:Date:Message-ID:X-Antivirus:X-Antivirus-Status;
	b=KifANc9UKLW0O/8DvzmNyDM6DvkeULFid29JFOKgYTy8t2lqlXj1GEYT+aHas/
	cxKYfLb5ivaT79daL/G1xNF0R4mAqd6rbvjGBovTGNBgQ/K5J376fWADQTGIn+nO
	5dfgqbTLvT4WnvVnyVCXSKiqaO+0RPkMbacIUq2gfkyRE=;

but the headers shown by Spamcop after the parse became changed to:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=viverelavela.com; s=turbo-smtp; x=1544178043; h=DomainKey-Signature:
Received:Received:MIME-Version:From:Reply-To:To:Subject:
Content-Type:Content-Transfer-Encoding:Date:Message-ID; bh=K3Oe1
	kiUPrPyJIlOVf2MjQxxIABLTrz3/oGMMhm7Dfc=; b=Penr5h12pXZlZ4bS0rJDX
	OrHXneQnHej1GkJqeKVhBj3r8AbVL0mxtVpv6fOwwbwToAGLhYacs+g6HvgMYjRc
	uGom/zmkT7tSNevd591f5D5PVeq5Lfbvh8Qv0DDrf+xfYrEIu+P+o1rEcm/DXDBT
	RQYbAiMvI/1SuVBiadzNpcDomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
	s=turbo-smtp; d=viverelavela.com;
	h=Received:Received:X-TurboSMTP-Tracking:Return-Path:MIME-Version:From:Reply-To:To:Subject:Content-Type:Content-Transfer-Encoding:X-Mailer:Date:Message-ID:X-Antivirus:X-Antivirus-Status;
	b=KifANc9UKLW0O/8DvzmNyDM6DvkeULFid29JFOKgYTy8t2lqlXj1GEYT+aHas/
	cxKYfLb5ivaT79daL/G1xNF0R4mAqd6rbvjGBovTGNBgQ/K5J376fWADQTGIn+nO
	5dfgqbTLvT4WnvVnyVCXSKiqaO+0RPkMbacIUq2gfkyRE=;

 

Edited December 4, 2018 by efa

[efa 0]

DKIM signature is about a standard feature these days, is parsing engine still developed?

[gnarlymarley 0]

1 hour ago, efa said:

is parsing engine still developed?

I believe it is still being developed.  I have occasional chat with the deputies where they are working with the developers.  I did run across this report that seems to have a DKIM in it and it seems to have parsed just fine.

https://www.spamcop.net/sc?id=z6505637534zf5ee6366a44d8e4afea7141b95ecf3a8z

[efa 0]

in that case the parsing was correct, so apparently happen only sometimes