Ok I can't wrap my head around this header ordering..
I'm using postfix with milter chain opendkim -> opendmarc -> amavisd-milter. Here's a sanitized example Return-Path: <[email protected]> X-Original-To: [email protected] X-Spam-Status: ... Received: from xxx (xxx [1.2.3.4]) by hege.li (Postfix) with ESMTP id xxxxxxxx for <[email protected]>; Thu, 8 Nov 2018 16:55:03 +0200 (EET) Authentication-Results: hege.li; dmarc=none (p=none dis=none) header.from=xxx Authentication-Results: hege.li; spf=pass smtp.mailfrom=xxx Authentication-Results: hege.li; dkim=pass (1024-bit key; unprotected) header.d=xxx.com [email protected] header.b=xxx; dkim-atps=neutral DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=xxx.com; s=s1024; ... Received: from xxx.com ... From: Fubar <[email protected]> SA doesn't find Authentication-Results from internal headers, since they are after my internal Received line, thus they are considered external, right? Are A-R headers in wrong position, should they be before my own Received header? Is this the fault of opendkim/dmarc, amavisd-miltes/amavis or postfix? Or should SA find the Authentication-Results headers even if they are after my internal header? But xxx.com generated DKIM-Signature is there too, so they surely can't be considered internally added headers? What is the correct logic here?
