On 13.08.26 15:48, Peymaneh Nejad via Postfix-users wrote:
I have a question about the correct usage of the FILTER directive in
access controls. It seems that our current setup allows for forged,
unauthenticated mails for our domain to be signed with our DKIM
signature.
I am maintaining a mail server with mostly App-managed "dummy"
accounts/identities, for which there is no need of spam filtering.
Only a few mailboxes, like [email protected], are ever reviewed by
humans, and for these we use spamassassin to rewrite the subject
header with ****Spam**** (no blocking).
Because we only selectively use spamassassin based on the recipient
mail, we do not use the milter interface but instead do this:
main.cf:
```
smtpd_recipient_restrictions =
check_recipient_access hash:/etc/postfix/spamfilter_access,
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination,
check_policy_service unix:private/policy-spf
```
Where this is the content of /etc/postfix/spamfilter_access:
```
[email protected] FILTER spamassassin:
...
```
Now it seems that this setups allows unauthenticated and forged mails
from a nonexistent user via port 25 to be signed with a DKIM signature
by us:
Neither of these calls opendkim
2026-08-11T10:37:19.663155+02:00 mail postfix/pickup[3929985]:
A1D22A40005: uid=131 from=<MAILER-DAEMON>
2026-08-11T10:37:19.663913+02:00 mail postfix/pipe[520894]:
1ABE0A40002: to=<[email protected]>, orig_to=<[email protected]>,
relay=spamassassin, delay=0.58, delays=0.18/0/0/0.4, dsn=2.0.0,
status=sent (delivered via spamassassin service)
2026-08-11T10:37:19.663974+02:00 mail postfix/qmgr[3958735]: 1ABE0A40002:
removed
2026-08-11T10:37:19.664835+02:00 mail postfix/cleanup[486649]:
A1D22A40005: message-id=<[email protected]>
2026-08-11T10:37:19.667515+02:00 mail opendkim[3959515]: A1D22A40005:
DKIM-Signature field added (s=mail, d=example.org)
this seems to be your problem.
SpamAssassin feeds the received mail to postfix via local service, so
opendkim thinks the mail originates locally.
How do you call opendkim?
Perhaps it could run as milter before FILTER catches?
And what does your spamassassin filter do?
Perhaps it could feed mail back to postfix on a port where opendkim does not
run?
--
Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Depression is merely anger without enthusiasm.
_______________________________________________
Postfix-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
