Re: PATCH: Glibc-2.31 DNSSEC and GCC 10

2020-04-28 Thread Wietse Venema
Florian Weimer: > * Wietse Venema: > > > Florian Weimer: > >> * Wietse Venema: > >> > >> > Florian Weimer: > >> >> * Wietse Venema: > >> >> > >> >> > Florian Weimer: > >> >> >> * Rich Felker: > >> >> >> > >> >> >> > A solution that would work with existing and future versions of > >> >> >> >

Re: PATCH: Glibc-2.31 DNSSEC and GCC 10

2020-04-28 Thread Florian Weimer
* Wietse Venema: > Florian Weimer: >> * Wietse Venema: >> >> > Florian Weimer: >> >> * Wietse Venema: >> >> >> >> > Florian Weimer: >> >> >> * Rich Felker: >> >> >> >> >> >> > A solution that would work with existing and future versions of musl >> >> >> > as well as glibc, and would (I think)

Re: PATCH: Glibc-2.31 DNSSEC and GCC 10

2020-04-28 Thread Wietse Venema
Florian Weimer: > * Wietse Venema: > > > Florian Weimer: > >> * Wietse Venema: > >> > >> > Florian Weimer: > >> >> * Rich Felker: > >> >> > >> >> > A solution that would work with existing and future versions of musl > >> >> > as well as glibc, and would (I think) avoid the need to poke at _res

Re: PATCH: Glibc-2.31 DNSSEC and GCC 10

2020-04-28 Thread Florian Weimer
* Wietse Venema: > Florian Weimer: >> * Wietse Venema: >> >> > Florian Weimer: >> >> * Rich Felker: >> >> >> >> > A solution that would work with existing and future versions of musl >> >> > as well as glibc, and would (I think) avoid the need to poke at _res >> >> > to set the glibc trustad

Re: PATCH: Glibc-2.31 DNSSEC and GCC 10

2020-04-28 Thread Wietse Venema
Florian Weimer: > * Wietse Venema: > > > Florian Weimer: > >> * Rich Felker: > >> > >> > A solution that would work with existing and future versions of musl > >> > as well as glibc, and would (I think) avoid the need to poke at _res > >> > to set the glibc trustad flag, would be replacing the

Re: PATCH: Glibc-2.31 DNSSEC and GCC 10

2020-04-28 Thread Florian Weimer
* Wietse Venema: > Florian Weimer: >> * Rich Felker: >> >> > A solution that would work with existing and future versions of musl >> > as well as glibc, and would (I think) avoid the need to poke at _res >> > to set the glibc trustad flag, would be replacing the call to >> > res_query with

Re: why DMARC PASS even SPF got failed

2020-04-28 Thread Bill Cole
On 28 Apr 2020, at 4:42, Philip wrote: Hello I sent a message from mail.ru, who has p=reject setting in their DMARC record, to an email account at OVH. OVH forwards this email to gmail, as we know during the forwarding OVH doesn't implement SRS. So after receiving the email, gmail shows

Re: PATCH: Glibc-2.31 DNSSEC and GCC 10

2020-04-28 Thread Wietse Venema
Florian Weimer: > * Rich Felker: > > > A solution that would work with existing and future versions of musl > > as well as glibc, and would (I think) avoid the need to poke at _res > > to set the glibc trustad flag, would be replacing the call to > > res_query with res_mkquery, |='ing the AD bit

OFF-TOPIC: Re: [External] Re: why DMARC PASS even SPF got failed

2020-04-28 Thread Kevin A. McGrail
> Scott, I have another question. Gents, I love geeking about email and spam techniques but these are not postfix related nor do they relate to beer*.  IMO these should be discussed elsewhere. Regards, KAM * There are some mailing lists with exclusions that discussions on beer are always

Re: why DMARC PASS even SPF got failed

2020-04-28 Thread Benny Pedersen
On 2020-04-28 14:17, Matus UHLAR - fantomas wrote: however, SPF will not fail here. So, sender using DKIM and forwarder using SRS fill make both SPF and DMARC pass. spf domain changes on next-hop, so its another domains spf that deside if spf pass or not pass, might be why postfix maillist

Re: why DMARC PASS even SPF got failed

2020-04-28 Thread Scott Kitterman
On Tuesday, April 28, 2020 8:17:54 AM EDT Matus UHLAR - fantomas wrote: > >>Scott Kitterman wrote: > >>> Yes. If either passes and the relevant identifier is aligned, DMARC > >>> passes. > > > >On April 28, 2020 9:29:59 AM UTC, Philip wrote: > >>Scott, I have another question. > >>Given the case

Re: why DMARC PASS even SPF got failed

2020-04-28 Thread Matus UHLAR - fantomas
Scott Kitterman wrote: Yes. If either passes and the relevant identifier is aligned, DMARC passes. On April 28, 2020 9:29:59 AM UTC, Philip wrote: Scott, I have another question. Given the case there is no DKIM signed in original message, when forwarding MTA implement a SRS in the outgoing

Re: postfix + forwadgroup + external amavis with haproxy and no_address_mappings

2020-04-28 Thread Matus UHLAR - fantomas
On 28.04.20 10:15, natan maciej milaszewski wrote: I have debian 9 and postfix 3.1.14. Generally, I have distributed mail traffic over several machines #other go to amavis 0.0.0.0/0 FILTER smtp-amavis:[127.0.0.1]:10628 master.cf: smtp-amavis unix    -   -   -   -   80   

Re: postfix + forwadgroup + external amavis with haproxy and no_address_mappings

2020-04-28 Thread natan maciej milaszewski
Hi In that configurations cannot work delimiter in main.cf exists recipient_delimiter = + On 28.04.2020 10:15, natan maciej milaszewski wrote: > Hi > I have debian 9 and postfix 3.1.14. Generally, I have distributed mail > traffic over several machines > > - separately for sent mail - here I

Re: why DMARC PASS even SPF got failed

2020-04-28 Thread Scott Kitterman
On April 28, 2020 9:29:59 AM UTC, Philip wrote: >Scott Kitterman wrote: >> Yes. If either passes and the relevant identifier is aligned, DMARC >passes. > >Scott, I have another question. >Given the case there is no DKIM signed in original message, when >forwarding MTA implement a SRS in the

Re: why DMARC PASS even SPF got failed

2020-04-28 Thread Scott Kitterman
On April 28, 2020 9:20:01 AM UTC, Philip wrote: >Scott Kitterman wrote: >> I predict you won't find this a satisfying answer, but the rest of >RFC 7489. >> >> Instead of quoting bits of various web sites and how-to's back and >forth, l think it makes sense to read the actual specification if

Re: why DMARC PASS even SPF got failed

2020-04-28 Thread Scott Kitterman
On April 28, 2020 8:58:28 AM UTC, Philip wrote: >Scott Kitterman wrote: >>> My question is, since SPF got SOFTFAIL by gmail, why it still says >>> DMARC >>> PASS? Shouldn't SPF failed cause DMARC failure? >> No. See RFC 7489, Section 4.2, last paragraph. > >what's the background knowledge? >

Re: why DMARC PASS even SPF got failed

2020-04-28 Thread Scott Kitterman
On April 28, 2020 8:42:20 AM UTC, Philip wrote: >Hello > >I sent a message from mail.ru, who has p=reject setting in their DMARC >record, to an email account at OVH. > >OVH forwards this email to gmail, as we know during the forwarding OVH >doesn't implement SRS. So after receiving the

Re: Gmail and spam, a request

2020-04-28 Thread Ralph Seichter
* pgndev: > https://dmarc.org/2017/03/can-i-use-dmarc-if-i-have-only-deployed-spf/ > > "... > you can use DMARC with only SPF – and absolutely should, at least as far as > enabling reporting – > ..." Tut, tut... Partial quotes, out of context. How desperate some of you have become. The relevant

postfix + forwadgroup + external amavis with haproxy and no_address_mappings

2020-04-28 Thread natan maciej milaszewski
Hi I have debian 9 and postfix 3.1.14. Generally, I have distributed mail traffic over several machines - separately for sent mail - here I have postfix - separately for incoming e-mails - here I have postfix + external amavis The general outline is this: 1) mail arrives at postfix 2) postfix

Re: PATCH: Glibc-2.31 DNSSEC and GCC 10

2020-04-28 Thread Florian Weimer
* Rich Felker: > A solution that would work with existing and future versions of musl > as well as glibc, and would (I think) avoid the need to poke at _res > to set the glibc trustad flag, would be replacing the call to > res_query with res_mkquery, |='ing the AD bit into place, then > res_send.