I run amavisd to do spamassassin scanning on outbound email. - Port
587 submission --> ORIGINATING/MYNETS dedicated amavisd port (10026)
--> Postfix 10025 for delivery --> Internet (OR local Cyrus if it's
local mail... read on...)
I also use amavisd to DKIM sign outbound email.
When I send email to a local domain (i.e. handled entirely on the
local network), amavisd is spam-scanning and *then* DKIM signing...
which means that the spam scan triggers KAM_DMARC rules if DMARC is
set to reject or quarantine:
- SPF fails: it's only ever internal, so SPF will never pass an
externally published SPF rule
- DKIM fails: the email is not yet DKIM-signed, so DKIM fails
- In SA this KAM rule fails:
meta KAM_DMARC_REJECT !(DKIM_VALID_AU || SPF_PASS) &&
__KAM_DMARC_POLICY_REJECT
describe KAM_DMARC_REJECT DKIM has Failed or SPF has failed on
the message and the domain has a DMARC reject policy
score KAM_DMARC_REJECT 3.0
I understand DKIM signing needs to be as late as possible - is there
an amavisd way to get around this challenge?
Simon.
--
Simon Wilson
M: 0400 12 11 16
