On 2026/06/27 01:53, Vittorio wrote:
Hello Edmund,
Hello Vittorio,
Thank you for replying!
My short answer: a DSN is a new message. ...
Correct.
This is probably where the confusion regarding my question comes in: My
complications are with regards to the embedded original message within
the DSN (and I agree that the DSN is a completely new message, which
needs to somehow be DKIM2 signed itself).
its standard bounce logic. The DKIM2 signing milter signs it as any
other outbound message with the envelope values as presented by the MTA.
In Postfix, this appears not to be the case, as referred to in my
previous email.
Postfix will not run the DSN message through the milters, so no DKIM2
signing will happen. Unless you enable a specific option, which then
routes the message through all kinds of things, and Postfix itself
suggests that it is not really safe to do so.
There is no recipe to undo, no prior chain state to extract or embed and
no DKIM2-specific DSN generation path.
This part applies not to the DSN (it is a new message, as you point
out), but to the original message. Here we have a few issues:
1.) When our mail server received the message and sent the "250 OK" to
the previous hop, it added a DKIM2 signature and MI to the original
message, before it passed it on to the next hop. The next hop, however,
refused to accept the message with a 5xx.
The original message is often embedded in the DSN (for Postfix, see
[0]), but now that original message has our DKIM2 sig + MI in its
headers, which we might want to unroll. They are of no use to the
original sender.. This is my question.
2.) Based on the size of the original message, Postfix will either embed
the full original message, or only the headers [1]. This size can be set
manually, and Postfix admins need to be (made) aware of this.
The milter does not need to know
that the message is a bounce.
This applies to the DSN again.
Regards
Vittorio Moccia
Kind regards,
Edmund Lodewijks
--
Edmund Lodewijks <[email protected]>
TZ: UTC+2 / GMT+2
_______________________________________________
Ietf-dkim mailing list -- [email protected]
To unsubscribe send an email to [email protected]
