Hello Bron, On 2026/06/26 00:39, Bron Gondwana wrote:
whathappenedtoyourwhitespace?
I don't know and I am Very embarrassed! I must have tripped up my Thunderbird somehow.
Why are you generating a DSN? If it's for "we decided to reject it later" then it's your delivery pipeline post-postfix.
Yes, based on content filtering, quota, etc.. Now Postfix will create a DSN, but how does it get signed with DKIM2?
Update: I see now that Postfix has an option `internal_mail_filter_classes` [0], which would route the bounce message through `non_smtpd_milters`, `header_checks`, and `body_checks`. However, Postfix warns that it is generally not safe to do so. One would, ideally, want to have bounce messages just routed through the DKIM2 milter/filter, but, as asked in the original mail, probably not hand-rolled by each sysadmin with a pipe?
If it's a "user doesn't exist" I'd probably do a catchall alias per domain which was a pipe to a DSN generator; if you can't reject during the SMTP transaction. You can still reject during the SMTP transaction of course.
Yes, during SMTP would be ideal. Otherwise, same wiring problem as above.
I haven't thought hard about how to do that phase, if you're the outbound smtp client in postfix and the NEXT hop rejects. We will need to figure that answer out I guess. I'll see what I can write up for it.
This is the more complicated case, yes. My reading of it: We accepted a message ("205 OK" to original.com); we added our own DKIM2 sig and recipe modification; we forward it to nexthop.com, who says 5xx.
Do we now remove/undo our recipe modification and sig; recreate the original message as we received it, and embed it in a DSN? Then we sign DSN fresh with d= original's top rt, mf=<>. Does that sound right?
Bron.
Thank you for your replies! Edmund [0]: https://www.postfix.org/postconf.5.html#internal_mail_filter_classes -- Edmund Lodewijks <[email protected]> TZ: UTC+2 / GMT+2 _______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
