Re: [dmarc-ietf] Indirect mail flows: DKIM signature breakage by cloud anti-virus/spam provider

2014-09-15 Thread Stephen J. Turnbull
Murray S. Kucherawy writes: > better yet, do DKIM verification prior to AV processing. This looks like the best bet to me. Especially if the AV processor charges by the message: perhaps you can reject or approve before submitting to the AV. ;-) ___ d

Re: [dmarc-ietf] Indirect mail flows: DKIM signature breakage by cloud anti-virus/spam provider

2014-09-15 Thread Roland Turner
On 09/16/2014 11:42 AM, Dave Crocker wrote: On 9/15/2014 7:00 PM, Roland Turner wrote: As I understand it, most advertisers maintain a "nuclear ambiguity" about the effectiveness of their activities, making measurements rather difficult to obtain. Every presentation I've seen from usability (

Re: [dmarc-ietf] Indirect mail flows: DKIM signature breakage by cloud anti-virus/spam provider

2014-09-15 Thread Dave Crocker
On 9/15/2014 7:00 PM, Roland Turner wrote: > As I understand it, most advertisers maintain a "nuclear ambiguity" > about the effectiveness of their activities, making measurements rather > difficult to obtain. Every presentation I've seen from usability (human factors, UX, ...) specialist has sai

[dmarc-ietf] Fwd: RFC 7372 on Email Authentication Status Codes

2014-09-15 Thread Murray S. Kucherawy
For later reference when registering enhanced status codes for DMARC. -MSK -- Forwarded message -- From: Date: Mon, Sep 15, 2014 at 5:23 PM Subject: RFC 7372 on Email Authentication Status Codes To: ietf-annou...@ietf.org, rfc-d...@rfc-editor.org Cc: drafts-update-...@iana.org, a

Re: [dmarc-ietf] Additional List-foo Header Field To Help Mitigate Mailing List Damage

2014-09-15 Thread Roland Turner
On 09/14/2014 05:59 AM, Steve Atkins wrote: On Sep 13, 2014, at 10:21 AM, Scott Kitterman wrote: It's a redefinition of the current meaning of the From: field, and the addition of another header to take the place of the existing From: field. That's bigger than DMARC, and it seems like the 532

Re: [dmarc-ietf] Indirect mail flows: DKIM signature breakage by cloud anti-virus/spam provider

2014-09-15 Thread Roland Turner
On 09/16/2014 08:27 AM, Dave Crocker wrote: On 9/15/2014 5:26 PM, Terry Zink wrote: Having the "Virus scanned by xxx" ***in a header*** defeats the purpose of advertising since most clients won’t display it. A/V filters put those taglines in there to advertise, not just to tell the mail client

Re: [dmarc-ietf] Indirect mail flows: DKIM signature breakage by cloud anti-virus/spam provider

2014-09-15 Thread Terry Zink
I'm not saying I agree that an A/V company is right to put their tagline into the message, especially if it breaks DKIM. If I owned an A/V company, I wouldn't do it [1]. However, I understand why A/V companies would do it - it (presumably) helps drive revenue because it increases visibility in

Re: [dmarc-ietf] Indirect mail flows: DKIM signature breakage by cloud anti-virus/spam provider

2014-09-15 Thread Dave Crocker
On 9/15/2014 5:26 PM, Terry Zink wrote: > Having the "Virus scanned by xxx" ***in a header*** defeats the purpose > of advertising since most clients won’t display it. A/V filters put > those taglines in there to advertise, not just to tell the mail client > that their mail has been scanned. And

Re: [dmarc-ietf] Indirect mail flows: DKIM signature breakage by cloud anti-virus/spam provider

2014-09-15 Thread Terry Zink
Er, what I meant was this: Having the "Virus scanned by xxx" ***in a header*** defeats the purpose of advertising since most clients won’t display it. A/V filters put those taglines in there to advertise, not just to tell the mail client that their mail has been scanned. -- Terry From: Murray

Re: [dmarc-ietf] Indirect mail flows: DKIM signature breakage by cloud anti-virus/spam provider

2014-09-15 Thread Murray S. Kucherawy
How will most mail clients know not to display it if it's made part of the body? On Mon, Sep 15, 2014 at 4:39 PM, Terry Zink wrote: > Having the "Virus scanned by xxx" defeats the purpose of advertising > because most mail clients won't display it, and the point of adding this to > the body is s

Re: [dmarc-ietf] Indirect mail flows: DKIM signature breakage by cloud anti-virus/spam provider

2014-09-15 Thread Terry Zink
Having the "Virus scanned by xxx" defeats the purpose of advertising because most mail clients won't display it, and the point of adding this to the body is so that other people can see it. I think Murray's earlier suggestion to perform the DKIM check before A/V filtering is the best option. --

Re: [dmarc-ietf] Indirect mail flows: DKIM signature breakage by cloud anti-virus/spam provider

2014-09-15 Thread John Levine
In article you write: >-=-=-=-=-=- >-=-=-=-=-=- > >In Denmark we have a somewhat large (10K+ domains) anti-virus/spam provider >breaking DKIM signatures. >They break DKIM signatures on incoming email by adding a "Virus scanned by >" line to the body of the email. > >Not sure how to fix this,

Re: [dmarc-ietf] Indirect mail flows: DKIM signature breakage by cloud anti-virus/spam provider

2014-09-15 Thread Dave Warren
On 2014-09-15 10:39, Henrik Schack wrote: In Denmark we have a somewhat large (10K+ domains) anti-virus/spam provider breaking DKIM signatures. They break DKIM signatures on incoming email by adding a "Virus scanned by " line to the body of the email. Not sure how to fix this, but perhaps

Re: [dmarc-ietf] Additional List-foo Header Field To Help Mitigate Mailing List Damage

2014-09-15 Thread Scott Kitterman
On Monday, September 15, 2014 12:46:02 Brandon Long wrote: > On Sun, Sep 14, 2014 at 12:34 PM, Scott Kitterman > > wrote: > > I can (an plan to) write code that leverages their X-Original-To. I'd > > rather have something standardized, but it's not essential for me to solve > > the problem I'm h

Re: [dmarc-ietf] Additional List-foo Header Field To Help Mitigate Mailing List Damage

2014-09-15 Thread Brandon Long
On Sun, Sep 14, 2014 at 12:34 PM, Scott Kitterman wrote: > > I can (an plan to) write code that leverages their X-Original-To. I'd > rather have something standardized, but it's not essential for me to solve > the problem I'm having. For the broader internet, I'm not so sure. (assuming you mea

Re: [dmarc-ietf] Indirect mail flows: DKIM signature breakage by cloud anti-virus/spam provider

2014-09-15 Thread Murray S. Kucherawy
Though I would never put such a thing in a standards document, OpenDKIM does have the capability to rewrite arriving header fields prior to signing/verifying to overcome things like this. Your ESP's verifier could be trained to ignore the added line prior to verifying, or better yet, do DKIM verif

Re: [dmarc-ietf] Indirect mail flows: DKIM signature breakage by cloud anti-virus/spam provider

2014-09-15 Thread Henrik Schack
No it's not at all a free service. But they advertise anyway :-( Br Henrik On Mon, Sep 15, 2014 at 9:28 PM, Franck Martin wrote: > > On Sep 15, 2014, at 7:39 PM, Henrik Schack > wrote: > > > In Denmark we have a somewhat large (10K+ domains) anti-virus/spam > provider breaking DKIM signatures.

Re: [dmarc-ietf] Indirect mail flows: DKIM signature breakage by cloud anti-virus/spam provider

2014-09-15 Thread Franck Martin
On Sep 15, 2014, at 7:39 PM, Henrik Schack wrote: > In Denmark we have a somewhat large (10K+ domains) anti-virus/spam provider > breaking DKIM signatures. > They break DKIM signatures on incoming email by adding a "Virus scanned by > " line to the body of the email. > > Not sure how to f

Re: [dmarc-ietf] Indirect mail flows: DKIM signature breakage by cloud anti-virus/spam provider

2014-09-15 Thread Henrik Schack
In this case it's not a header, but a line added to the body of the email Br Henrik Schack On Sep 15, 2014 8:51 PM, "Tomki" wrote: > Henrik, > I think that the fact of virus scanning is more commonly just another > header in the message, which would not break a properly created > DKIM-Signature.

Re: [dmarc-ietf] Indirect mail flows: DKIM signature breakage by cloud anti-virus/spam provider

2014-09-15 Thread Tomki
Henrik, I think that the fact of virus scanning is more commonly just another header in the message, which would not break a properly created DKIM-Signature. For example your message (via the list) got to me with extra headers such as: X-IronPort-AV, X-IronPort-AS Perhaps that example from an

[dmarc-ietf] Indirect mail flows: DKIM signature breakage by cloud anti-virus/spam provider

2014-09-15 Thread Henrik Schack
In Denmark we have a somewhat large (10K+ domains) anti-virus/spam provider breaking DKIM signatures. They break DKIM signatures on incoming email by adding a "Virus scanned by " line to the body of the email. Not sure how to fix this, but perhaps some day they'll get tired of my bi-monthly ca