kerem commented

Owner

Originally created by @blackhold on GitHub (Mar 2, 2023).
Original GitHub issue: https://github.com/modoboa/modoboa/issues/2892

Impacted versions

OS Type: Debian
OS Version: 11.6
Database Type: PostgreSQL
Modoboa: 2.0.3
installer used: Yes
Webserver: Nginx

Steps to reproduce

Send an email to outlook mail account

Current behavior

I send an email to a outlook account and in mail.log appears:

Mar  2 13:19:15 mail opendkim[497]: CF3DD41669: DKIM-Signature field added (s=mail, d=mydomain.com)

But in headers of received mail I see:

Authentication-Results: spf=temperror (sender IP is 51.15.XX.XX)
 smtp.mailfrom=mydomain.com; dkim=fail (no key for signature)
 header.d=mydomain.com;dmarc=temperror action=none
 header.from=mydomain.com;compauth=pass reason=105
Received-SPF: TempError (protection.outlook.com: error in processing during
 lookup of mydomain.com: DNS Timeout)
Received: from mail.mydomain.com (51.15.XX.XX) by
 DB5EUR01FT016.mail.protection.outlook.com (10.152.4.255) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 15.20.6156.12 via Frontend Transport; Thu, 2 Mar 2023 12:19:16 +0000
Received: from localhost (localhost [127.0.0.1])
	by mail.mydomain.com (Postfix) with ESMTP id CF3DD41669
	for <user@domain.edu>; Thu,  2 Mar 2023 13:19:15 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mydomain.com;
	s=mail; t=1677759555;
	bh=WyK/xd9Bo337EPul*****s=;
	h=Subject:From:To:Date:From;
	b=dJpi********M=
X-Virus-Scanned: Debian amavisd-new at mail.mydomain.com

my original domain is replaced by mydomain.com

If I use https://www.dmarcanalyzer.com/es/dkim-3/dkim-record-check/ tells dkim signature is ok

My dns configuration is:

@ IN MX 10 mail.mydomain.com.
@ IN TXT "v=spf1 a mx ~all"
mail._domainkey.mydomain.com. IN TXT (  "v=DKIM1;k=rsa;p=MIICIj****==")
_dmarc.mydomain.com. IN TXT "v=DMARC1; p=none; pct=100; rua=mailto:abuse@myotherdomain.net; adkim=s"

My master.conf certificates configuration is

## TLS settings
#
smtpd_use_tls = yes
smtpd_tls_auth_only = no
smtpd_tls_CApath = /etc/ssl/certs
#smtpd_tls_key_file = /etc/ssl/private/mail.mydomain.com.key
#smtpd_tls_cert_file = /etc/ssl/certs/mail.mydomain.com.cert
smtpd_tls_key_file = /etc/letsencrypt/live/mail.mydomain.com/privkey.pem
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.mydomain.com/fullchain.pem
smtpd_tls_dh1024_param_file = ${config_directory}/dh2048.pem
smtpd_tls_loglevel = 1
smtpd_tls_session_cache_database = btree:$data_directory/smtpd_tls_session_cache
smtpd_tls_security_level = may
smtpd_tls_received_header = yes
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

# Disallow SSLv2 and SSLv3, only accept secure ciphers
smtpd_tls_protocols = !SSLv2, !SSLv3
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_mandatory_ciphers = high
smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5 , DES, ADH, RC4, PSD, SRP, 3DES, eNULL
smtpd_tls_exclude_ciphers = aNULL, MD5 , DES, ADH, RC4, PSD, SRP, 3DES, eNULL

# Enable elliptic curve cryptography
smtpd_tls_eecdh_grade = strong

# Use TLS if this is supported by the remote SMTP server, otherwise use plaintext.
smtp_tls_CApath = /etc/ssl/certs
smtp_tls_security_level = may
smtp_tls_loglevel = 1
smtp_tls_exclude_ciphers = EXPORT, LOW

Dovecot's certificate configuration is (/etc/dovecot/conf.d/10-ssl-keys.try):

ssl_cert = </etc/letsencrypt/live/mail.mydomain.com/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.mydomain.com/privkey.pem

The other configuration is the default of the installer.

Expected behavior

DKIM signature appear in outlook mails and mail delivered to microsoft not enter to spam folder

Originally created by @blackhold on GitHub (Mar 2, 2023). Original GitHub issue: https://github.com/modoboa/modoboa/issues/2892 # Impacted versions * OS Type: Debian * OS Version: 11.6 * Database Type: PostgreSQL * Modoboa: 2.0.3 * installer used: Yes * Webserver: Nginx # Steps to reproduce Send an email to outlook mail account # Current behavior I send an email to a outlook account and in mail.log appears: ``` Mar 2 13:19:15 mail opendkim[497]: CF3DD41669: DKIM-Signature field added (s=mail, d=mydomain.com) ``` But in headers of received mail I see: ``` Authentication-Results: spf=temperror (sender IP is 51.15.XX.XX) smtp.mailfrom=mydomain.com; dkim=fail (no key for signature) header.d=mydomain.com;dmarc=temperror action=none header.from=mydomain.com;compauth=pass reason=105 Received-SPF: TempError (protection.outlook.com: error in processing during lookup of mydomain.com: DNS Timeout) Received: from mail.mydomain.com (51.15.XX.XX) by DB5EUR01FT016.mail.protection.outlook.com (10.152.4.255) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6156.12 via Frontend Transport; Thu, 2 Mar 2023 12:19:16 +0000 Received: from localhost (localhost [127.0.0.1]) by mail.mydomain.com (Postfix) with ESMTP id CF3DD41669 for <user@domain.edu>; Thu, 2 Mar 2023 13:19:15 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mydomain.com; s=mail; t=1677759555; bh=WyK/xd9Bo337EPul*****s=; h=Subject:From:To:Date:From; b=dJpi********M= X-Virus-Scanned: Debian amavisd-new at mail.mydomain.com ``` my original domain is replaced by mydomain.com If I use https://www.dmarcanalyzer.com/es/dkim-3/dkim-record-check/ tells dkim signature is ok My dns configuration is: ``` @ IN MX 10 mail.mydomain.com. @ IN TXT "v=spf1 a mx ~all" mail._domainkey.mydomain.com. IN TXT ( "v=DKIM1;k=rsa;p=MIICIj****==") _dmarc.mydomain.com. IN TXT "v=DMARC1; p=none; pct=100; rua=mailto:abuse@myotherdomain.net; adkim=s" ``` My master.conf certificates configuration is ``` ## TLS settings # smtpd_use_tls = yes smtpd_tls_auth_only = no smtpd_tls_CApath = /etc/ssl/certs #smtpd_tls_key_file = /etc/ssl/private/mail.mydomain.com.key #smtpd_tls_cert_file = /etc/ssl/certs/mail.mydomain.com.cert smtpd_tls_key_file = /etc/letsencrypt/live/mail.mydomain.com/privkey.pem smtpd_tls_cert_file = /etc/letsencrypt/live/mail.mydomain.com/fullchain.pem smtpd_tls_dh1024_param_file = ${config_directory}/dh2048.pem smtpd_tls_loglevel = 1 smtpd_tls_session_cache_database = btree:$data_directory/smtpd_tls_session_cache smtpd_tls_security_level = may smtpd_tls_received_header = yes smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt # Disallow SSLv2 and SSLv3, only accept secure ciphers smtpd_tls_protocols = !SSLv2, !SSLv3 smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3 smtpd_tls_mandatory_ciphers = high smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5 , DES, ADH, RC4, PSD, SRP, 3DES, eNULL smtpd_tls_exclude_ciphers = aNULL, MD5 , DES, ADH, RC4, PSD, SRP, 3DES, eNULL # Enable elliptic curve cryptography smtpd_tls_eecdh_grade = strong # Use TLS if this is supported by the remote SMTP server, otherwise use plaintext. smtp_tls_CApath = /etc/ssl/certs smtp_tls_security_level = may smtp_tls_loglevel = 1 smtp_tls_exclude_ciphers = EXPORT, LOW ``` Dovecot's certificate configuration is (/etc/dovecot/conf.d/10-ssl-keys.try): ``` ssl_cert = </etc/letsencrypt/live/mail.mydomain.com/fullchain.pem ssl_key = </etc/letsencrypt/live/mail.mydomain.com/privkey.pem ``` The other configuration is the default of the installer. # Expected behavior DKIM signature appear in outlook mails and mail delivered to microsoft not enter to spam folder

kerem closed this issue

2026-02-27 11:18:42 +03:00

kerem commented

2026-02-27 11:18:43 +03:00

Author

Owner

@Spitfireap commented on GitHub (Mar 2, 2023):

Hi, does this happen with other recipients ? Have you waited for the DNS to propagate and for the TTL to be expired ?

@Spitfireap commented on GitHub (Mar 2, 2023): Hi, does this happen with other recipients ? Have you waited for the DNS to propagate and for the TTL to be expired ?

kerem commented

2026-02-27 11:18:43 +03:00

Author

Owner

@blackhold commented on GitHub (Mar 2, 2023):

With gmail mails enters OK

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=user-agent:message-id:date:to:from:subject
         :content-transfer-encoding:mime-version:dkim-signature;
        bh=g3zL****************A==
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass header.i=@mydomain.com header.s=mail header.b=c3OdjnXm;
       spf=pass (google.com: domain of abuse@mydomain.com designates 51.15.xx.xx as permitted sender) smtp.mailfrom=abuse@mydomain.com;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=mydomain.com

the domain is configured almost one week ago, so the propagation should be ok

@blackhold commented on GitHub (Mar 2, 2023): With gmail mails enters OK ``` ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=user-agent:message-id:date:to:from:subject :content-transfer-encoding:mime-version:dkim-signature; bh=g3zL****************A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@mydomain.com header.s=mail header.b=c3OdjnXm; spf=pass (google.com: domain of abuse@mydomain.com designates 51.15.xx.xx as permitted sender) smtp.mailfrom=abuse@mydomain.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=mydomain.com ``` the domain is configured almost one week ago, so the propagation should be ok

kerem commented

2026-02-27 11:18:43 +03:00

Author

Owner

@Spitfireap commented on GitHub (Mar 2, 2023):

This seems to be more on the microsoft side, or perhaps that your DNS server is taking too much time to respond.

@Spitfireap commented on GitHub (Mar 2, 2023): This seems to be more on the [microsoft side](https://techcommunity.microsoft.com/t5/outlook/received-spf-temperror-protection-outlook-com-error-in/m-p/1801696), or perhaps that your DNS server is taking too much time to respond.

kerem commented

2026-02-27 11:18:43 +03:00

Author

Owner

@blackhold commented on GitHub (Mar 2, 2023):

wow! wait! I think I have solved!!! now I have these headers on microsoft mail and mail not entered in spam. I'm going to check for other domains right now

Authentication-Results: spf=pass (sender IP is 51.15.27.98)
 smtp.mailfrom=mydomain.com; dkim=pass (signature was verified)
 header.d=mydomain.com;dmarc=bestguesspass action=none
 header.from=mydomain.com;compauth=pass reason=109
Received-SPF: Pass (protection.outlook.com: domain of mydomain.com
 designates 51.15.27.98 as permitted sender) receiver=protection.outlook.com;
 client-ip=51.15.27.98; helo=mail.mydomain.com; pr=C
Received: from mail.mydomain.com (51.15.xx.xx) by
 DB5EUR01FT091.mail.protection.outlook.com (10.152.5.217) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 15.20.6156.20 via Frontend Transport; Thu, 2 Mar 2023 17:06:03 +0000
Received: from localhost (localhost [127.0.0.1])
	by mail.mydomain.com (Postfix) with ESMTP id AC1AC41671
	for <lmora@cicles.iccic.edu>; Thu,  2 Mar 2023 18:06:02 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mydomain.com;
	s=mail; t=1677776762;
	bh=3g7dCsSnBa/3DzRzTpCh0KHYt2q+S7U/Pqk0vBBbOxc=;
	h=Subject:From:To:Date:From;
	b=X3G********************g=

In DNS simply add this line

_adsp._domainkey.mydomain.com. IN TXT "dkim=discardable;"

If it works, I propose to add the configuration in modoboa

@blackhold commented on GitHub (Mar 2, 2023): wow! wait! I think I have solved!!! now I have these headers on microsoft mail and mail not entered in spam. I'm going to check for other domains right now ``` Authentication-Results: spf=pass (sender IP is 51.15.27.98) smtp.mailfrom=mydomain.com; dkim=pass (signature was verified) header.d=mydomain.com;dmarc=bestguesspass action=none header.from=mydomain.com;compauth=pass reason=109 Received-SPF: Pass (protection.outlook.com: domain of mydomain.com designates 51.15.27.98 as permitted sender) receiver=protection.outlook.com; client-ip=51.15.27.98; helo=mail.mydomain.com; pr=C Received: from mail.mydomain.com (51.15.xx.xx) by DB5EUR01FT091.mail.protection.outlook.com (10.152.5.217) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6156.20 via Frontend Transport; Thu, 2 Mar 2023 17:06:03 +0000 Received: from localhost (localhost [127.0.0.1]) by mail.mydomain.com (Postfix) with ESMTP id AC1AC41671 for <lmora@cicles.iccic.edu>; Thu, 2 Mar 2023 18:06:02 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mydomain.com; s=mail; t=1677776762; bh=3g7dCsSnBa/3DzRzTpCh0KHYt2q+S7U/Pqk0vBBbOxc=; h=Subject:From:To:Date:From; b=X3G********************g= ``` In DNS simply add this line ``` _adsp._domainkey.mydomain.com. IN TXT "dkim=discardable;" ``` If it works, I propose to add the configuration in modoboa

kerem commented

2026-02-27 11:18:43 +03:00

Author

Owner

@Spitfireap commented on GitHub (Mar 2, 2023):

DNS configuration is part of modoboa. Also, this TXT is just saying the same thing as p=reject for DMARC, if this really fixed the issue, that's on Microsoft side to fix (you should open a case with them).

@Spitfireap commented on GitHub (Mar 2, 2023): DNS configuration is part of modoboa. Also, this TXT is just saying the same thing as `p=reject` for DMARC, if this really fixed the issue, that's on Microsoft side to fix (you should open a case with them).

kerem commented

2026-02-27 11:18:43 +03:00

Author

Owner

@blackhold commented on GitHub (Mar 2, 2023):

are you kidding me? :P talk with microsoft to solve that problem? lol

Here I pase the working configuration for one of my domains, I'm trying with some more, but finally (crying! damn! finally!!!) got working mails for microsoft and them don't enters to spam

@ IN TXT "v=spf1 a mx ~all"
mail._domainkey.mydomain.com. IN TXT (
  "v=DKIM1;k=rsa;p=MIIC***********Q==")
;_dmarc IN TXT "v=DMARC1; p=quarantine; pct=100"
;_dmarc.mydomain.com. IN TXT "v=DMARC1; p=quarantine; pct=100; rua=mailto:admin@capa8.net; adkim=s"
_dmarc.mydomain.com. IN TXT "v=DMARC1; p=none; pct=100; rua=mailto:admin@mysuperdomain.net; adkim=s"
_adsp._domainkey.mydomain.com. IN TXT "dkim=discardable;"

There are some commented lines related to old configuration, but I think the solution is to add the adsp entry to DNS. Now with p=none works.

Thanks you much for duck debugging :P

UPDATE: if I use p=quarantine; enters to spam, if I use p=none; enters to inbox folder (in microsoft email address)
UPDATE2: if this configuration also works

_dmarc IN TXT "v=DMARC1; p=quarantine; pct=100"

@blackhold commented on GitHub (Mar 2, 2023): are you kidding me? :P talk with microsoft to solve that problem? lol Here I pase the working configuration for one of my domains, I'm trying with some more, but finally (crying! damn! finally!!!) got working mails for microsoft and them don't enters to spam ``` @ IN TXT "v=spf1 a mx ~all" mail._domainkey.mydomain.com. IN TXT ( "v=DKIM1;k=rsa;p=MIIC***********Q==") ;_dmarc IN TXT "v=DMARC1; p=quarantine; pct=100" ;_dmarc.mydomain.com. IN TXT "v=DMARC1; p=quarantine; pct=100; rua=mailto:admin@capa8.net; adkim=s" _dmarc.mydomain.com. IN TXT "v=DMARC1; p=none; pct=100; rua=mailto:admin@mysuperdomain.net; adkim=s" _adsp._domainkey.mydomain.com. IN TXT "dkim=discardable;" ``` There are some commented lines related to old configuration, but I think the solution is to add the adsp entry to DNS. Now with p=none works. Thanks you much for duck debugging :P UPDATE: if I use p=quarantine; enters to spam, if I use p=none; enters to inbox folder (in microsoft email address) UPDATE2: if this configuration also works ``` _dmarc IN TXT "v=DMARC1; p=quarantine; pct=100" ```

kerem commented

2026-02-27 11:18:43 +03:00

Author

Owner

@blackhold commented on GitHub (Mar 2, 2023):

I'm trying to push the changes I propose but I don't have permissions. (/cc @tonioo)

In my local repository/branch I edited these files with this content:

modoboa/dnstools/templates/dnstools/domain_dns_configuration.html (lines 24-26)

    ADSP
  <pre>
_adsp._domainkey.{{ domain.name }}. IN TXT "dkim=discardable;"</pre>

modoboa/dnstools/templates/dnstools/domain_dns_configuration.html (lines 44-46)

      <div class="title">ADSP</div>
      <pre>
_adsp._domainkey.{{ domain.name }}. IN TXT "dkim=discardable;"</pre>

Thanks

@blackhold commented on GitHub (Mar 2, 2023): I'm trying to push the changes I propose but I don't have permissions. (/cc @tonioo) In my local repository/branch I edited these files with this content: modoboa/dnstools/templates/dnstools/domain_dns_configuration.html (lines 24-26) ``` ADSP <pre> _adsp._domainkey.{{ domain.name }}. IN TXT "dkim=discardable;"</pre> ``` modoboa/dnstools/templates/dnstools/domain_dns_configuration.html (lines 44-46) ``` <div class="title">ADSP</div> <pre> _adsp._domainkey.{{ domain.name }}. IN TXT "dkim=discardable;"</pre> ``` Thanks

kerem commented

2026-02-27 11:18:43 +03:00

Author

Owner

@tonioo commented on GitHub (Mar 3, 2023):

@blackhold You need to fork this repo, commit your changes in your fork and then create a pull request :)

@tonioo commented on GitHub (Mar 3, 2023): @blackhold You need to fork this repo, commit your changes in your fork and then create a pull request :)

kerem commented

2026-02-27 11:18:43 +03:00

Author

Owner

@tonioo commented on GitHub (Mar 3, 2023):

But your issue is strange. You should not have to implement ADSP if you already have a DMARC policy. You might have an issue somewhere in your configuration...
I see this in your email headers: dmarc=bestguesspass, it should be pass if everything is properly configured.

@tonioo commented on GitHub (Mar 3, 2023): But your issue is strange. You should not have to implement ADSP if you already have a DMARC policy. You might have an issue somewhere in your configuration... I see this in your email headers: ``dmarc=bestguesspass``, it should be ``pass`` if everything is properly configured.

kerem commented

2026-02-27 11:18:43 +03:00

Author

Owner

@tonioo commented on GitHub (Mar 3, 2023):

https://wordtothewise.com/2015/05/dmarcbestguesspass/

@tonioo commented on GitHub (Mar 3, 2023): https://wordtothewise.com/2015/05/dmarcbestguesspass/

kerem commented

2026-02-27 11:18:43 +03:00

Author

Owner

@blackhold commented on GitHub (Mar 3, 2023):

Hi @tonioo I try this to fork and commit the changes.

For sure my domain is not mydomain.com :P in DNS I don't use in any case bestguesspass, I see it only appears in mail headers. I don't know in which part is changed to this value. In gmail this header isn't present.

I'm lot of years using modoboa (many thanks for this project!!! I would be delighted to be able to collaborate, when I started to use it, I never was able to mount a mail server and didn't know anything of django, now I have both knowledges thanks to you 🥰), and DNS configuration was always a problem, the thing that has always been pending is the mails to hotmail/outlook entered to spam, with adsp policy and right dmarc configuration seems the solution (in some domains I strictly use the DNS configuration you propose).

@blackhold commented on GitHub (Mar 3, 2023): Hi @tonioo I try this to fork and commit the changes. For sure my domain is not mydomain.com :P in DNS I don't use in any case bestguesspass, I see it only appears in mail headers. I don't know in which part is changed to this value. In gmail this header isn't present. I'm lot of years using modoboa (many thanks for this project!!! I would be delighted to be able to collaborate, when I started to use it, I never was able to mount a mail server and didn't know anything of django, now I have both knowledges thanks to you 🥰), and DNS configuration was always a problem, the thing that has always been pending is the mails to hotmail/outlook entered to spam, with adsp policy and right dmarc configuration seems the solution (in some domains I strictly use the DNS configuration you propose).

Rows
Columns

[GH-ISSUE #2892] opendkim adds key on sending message but hotmail tells the message is not signed #1710

Impacted versions

Steps to reproduce

Current behavior

Expected behavior