Re: just a test

["Charles E. Lehner" <cel@xxxxxxxxxxxx>]

Hi Benny, and Mick,

Mick, happily, your message also passed verification checks on my server:

Authentication-Results: celehner.com; dmarc=pass (p=reject dis=none) header.from=rs432.net
Authentication-Results: celehner.com; spf=pass smtp.mailfrom=dnswl.org
Authentication-Results: celehner.com;
	dkim=pass header.d=dnswl.org header.i=@dnswl.org header.a=ed25519-sha256 header.s=dnswl-ed25519-59hs header.b=B0S8m6H6;
	dkim=pass (2048-bit key; unprotected) header.d=dnswl.org header.i=@dnswl.org header.a=rsa-sha256 header.s=dnswl-rsa-wgJg header.b=FFgSbdgV;
	dkim=pass (2048-bit key; unprotected) header.d=rs432.net header.i=@rs432.net header.a=rsa-sha256 header.s=email header.b=dBw1BC/I;
	dkim-atps=neutral

(I didn't quote SPF verification in my previous message because, as I since realized, my mail server was not actually checking SPF! But that is now fixed.)

More reply below...

On Sat, 16 Jul 2022 14:28:35 +0200
Benny Pedersen <me@xxxxxxx> wrote:

> M Champion skrev den 2022-07-16 13:55:
> > On 16/07/2022 00:12, Benny Pedersen wrote:  
>  [...]  
>  [...]  
> > 
> > 
> > esec.uk; dmarc=pass (p=none dis=none) header.from=junc.eu
> > 
> > esec.uk; dkim=permerror (0-bit key) header.d=dnswl.org
> > header.i=@dnswl.org header.b="QESXNAoD"; dkim=pass (2048-bit key;
> > unprotected) header.d=dnswl.org header.i=@dnswl.org
> > header.b="VO4wvz/J"; dkim=pass (2048-bit key; secure)
> > header.d=junc.eu header.i=@junc.eu header.b="TuTmedAz";
> > dkim-atps=neutral  
> 
> super, no dnssec yet ?, what software gives 0-bit key ?, too old
> openssl ?, invalid dkim added ?,

I suppose that's what it looks like when the receiver/verifier does not support the signature algorithm (ed25519-sha256). In this case DMARC succeeds because the list server also signed using rsa-sha256, which passed.

> i see secure so something is using
> dnssec ? :)

Good for junc.eu (and the verifiers)!

...

Note I received one DMARC failure report in response to my previous message to the list. I believe this report was due to incorrect DKIM checking by that server (not checking the DKIM signature added by my mail server as sender, but only checking one of the DKIM signatures added by the list server). I alerted the corresponding subscriber and hostmaster about this. I'm pretty sure my DKIM and DMARC are correct, but would appreciate any (dis)confirmation of this from any list subscriber - and/or from any list poster who also received such a failure report whether you agree with my assessment.

Regards,
Charles