Subject: [ietf-dkim] DKIM software needed

From: "Charles Lindsey" <[email-masked]>
Date: Thu, 03 Mar 2011 11:18:45 -0000

Having just had a deluge of bogus messages from Twitter, all allegedly  
DKIM-signed, I think I need a working DKIM checker (my ISP has not  
implemented DKIM ckecking so far).

I have not the time to write my own, so can someone please point me to an  
implementation that could be deployed as a procmail filter. I have libssl  
which could preumably do the RSA stuff.

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131                       
   Web: http://www.cs.man.ac.uk/~chl
Email: [email-masked]      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Mark Martinec <[email-masked]>
Date: Thu, 3 Mar 2011 13:07:47 +0100

> which could preumably do the RSA stuff.

Running a DKIM checker on an MTA would be preferred to procmail,
less opportunity for mangling a message by all the sw components
in the mail path. But if you do not have a choice or for a low
traffic rate, try perl module Mail::DKIM, either directly from a
command line, or through SpamAssassin (command line or spamc/spamd).

Here is a simple one-liner, which takes a message from stdin
and reports a pass or fail for each signature found.
You can expand its functionality from there:

$ perl -MMail::DKIM::Verifier -ne '
BEGIN{$dkim=Mail::DKIM::Verifier->new_object};
s/\r?\n\z/\015\012/; $dkim->PRINT($_); END{$dkim->CLOSE;
printf("%s\n",$_->result_detail) for $dkim->signatures}'

But since you need to check Twitter signature forgeries, you
need more than a simple signature validator, it needs to be
coupled with some sort of ADSP or rules. If the twitter.com
did provide a signature with its 'd' tag matching the domain
in a From header field you could use an adsp_override rule,
but since they don't, you need something like the following
in your SpamAssassin configuration file local.cf:

full   __L_DKIM_VALID_TWITTER eval:check_dkim_valid(twitter.com)
header __L_FROM_TWITTER  From:addr =~ /[\@.]twitter\.com$/mi
meta   L_FAKE_TWITTER  __L_FROM_TWITTER && !__L_DKIM_VALID_TWITTER
score  L_FAKE_TWITTER  5

  Mark

---

From: Douglas Otis <[email-masked]>
Date: Fri, 04 Mar 2011 14:39:50 -0800

On 3/3/11 4:07 AM, Mark Martinec wrote:
> meta   L_FAKE_TWITTER  __L_FROM_TWITTER&&  !__L_DKIM_VALID_TWITTER
> score  L_FAKE_TWITTER  5
In addition, with or without ADSP, never assume valid DKIM signatures 
correspond with the From header being displayed or used for sorting. :^(

-Doug