Hi Matus,
Thanks for your message!
On 8/13/26 16:39, Matus UHLAR - fantomas via Postfix-users wrote:
On 13.08.26 15:48, Peymaneh Nejad via Postfix-users wrote:
main.cf:
```
smtpd_recipient_restrictions =
check_recipient_access hash:/etc/postfix/spamfilter_access,
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination,
check_policy_service unix:private/policy-spf
```
Where this is the content of /etc/postfix/spamfilter_access:
```
[email protected] FILTER spamassassin:
...
```
Now it seems that this setups allows unauthenticated and forged mails from a
nonexistent user via port 25 to be signed with a DKIM signature by us:
Neither of these calls opendkim
Sorry, I did not include that part of main.cf:
```
milter_default_action = accept
milter_protocol = 6
smtpd_milters =
inet:127.0.0.1:12301 # opendkim
inet:127.0.0.1:8893 # opendmarc
non_smtpd_milters = inet:localhost:12301
```
2026-08-11T10:37:19.663155+02:00 mail postfix/pickup[3929985]: A1D22A40005:
uid=131 from=<MAILER-DAEMON>
2026-08-11T10:37:19.663913+02:00 mail postfix/pipe[520894]: 1ABE0A40002:
to=<[email protected]>, orig_to=<[email protected]>, relay=spamassassin,
delay=0.58, delays=0.18/0/0/0.4, dsn=2.0.0, status=sent (delivered via
spamassassin service)
2026-08-11T10:37:19.663974+02:00 mail postfix/qmgr[3958735]: 1ABE0A40002:
removed
2026-08-11T10:37:19.664835+02:00 mail postfix/cleanup[486649]: A1D22A40005:
message-id=<[email protected]>
2026-08-11T10:37:19.667515+02:00 mail opendkim[3959515]: A1D22A40005: DKIM-
Signature field added (s=mail, d=example.org)
this seems to be your problem.
SpamAssassin feeds the received mail to postfix via local service, so opendkim
thinks the mail originates locally.
How do you call opendkim?
Perhaps it could run as milter before FILTER catches?
See the snipped above on how we call OpenDKIM.
To me the https://www.postfix.org/FILTER_README.html suggests that the "FILTER"
is a "after queue" filter action, is the current placement
(smtpd_recipient_restriction) an issue?
And what does your spamassassin filter do?
It (currently) only has a very minimal config with a few blacklisted addresses
and rewrites the header:
```
required_score 3.0
add_header spam Flag _YESNOCAPS_
add_header all Status _YESNO_, score=_SCORE_ required=_REQD_ tests=_TESTS_
autolearn=_AUTOLEARN_ version=_VERSION_
rewrite_header Subject [SPAM]
use_bayes 1
use_bayes_rules 1
use_pyzor 1
use_razor2 1
score RBL_SPAMHAUS_ZEN 3.0
blacklist_from [email protected]
blacklist_from ...
```
Perhaps it could feed mail back to postfix on a port where opendkim does not run
Excuse me if this is an ignorant question, but would you know how to let
spamassassin do that?
The postfix manpage states:
FILTER transport:destination
After the message is queued, send the entire message through the
specified external content filter. The transport name specifies
the first field of a mail delivery agent definition in mas-
ter.cf; the syntax of the next-hop destination is described in
the manual page of the corresponding delivery agent. More
information about external content filters is in the Postfix
FILTER_README file.
The spamassassin documentation does not provide any hints on its
usage/configuration as a "delivery agent"
Warm regards,
Peymaneh
_______________________________________________
Postfix-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
