Re: [exim] Help sought with fairly complex DKIM set up and F…

>>     * enforce DKIM tests domains that are 'known signers' (google,
>> facebook, etc) and explicitly accept or deny mail based on the result of
>> the DKIM checks - to avoid faked email
>>     * allow through mail with no signatures (obvious)
>>     * support a 'DKIM whitelist' for domains that send with DKIM but
>> have a known fault/problem
>>     * skip checks on hosts/domains we relay for
>>     * skip checks on authenticated connections from MUAs (clients)
>>     * defer if a message that has a signature is not testable, eg.
>> cannot retrieve their DKIM key, key has syntax error, etc.

>>         #
>>         # start of DKIM debug message and clear macro
>>         #
>>         warn    set acl_m2 = 0
>>                 logwrite = DKIM START: domain=$sender_address_domain
>> possible_signer=$dkim_cur_signer status=$dkim_verify_status ${if
>> def:dkim_verify_reason {(reason=$dkim_verify_reason) }}

>>         #
>>         # strict checking on known signers...
>>         #
>>         deny    sender_domains = +dkim_known_signers
>> #               dkim_signers = +dkim_known_signers
>>                 dkim_status = none:invalid:fail
>>                 message = Message from $sender_address_domain (known
>> signer) with invalid or missing signature
>>                 logwrite = DKIM DENY: Rejected $sender_address_domain is
>> known signer (in database) but has invalid/missing signature

>>         accept  sender_domains = +dkim_known_signers
>> #               dkim_signers = +dkim_known_signers
>>                 dkim_status = pass
>>                 logwrite = DKIM PASS: Accepted $sender_address_domain is
>> known signer and has good signature
>>                 add_header = :after_received:X-DKIM-Result:
>> Domain=$sender_address_domain Result=Good and Known Domain

>>         #
>>         # ignore noise where we have no signature
>>         #
>>         accept  dkim_status = none
>> #               logwrite = DKIM SKIP: Skipping DKIM checks - no
>> signature for: $dkim_cur_signer

>>         #
>>         # skip DKIM if domain whitelisted for DKIM, i.e. known good
>> domain that has broken DKIM
>>         #
>>         accept  sender_domains = +dkim_whitelist_domains
>>                 logwrite = DKIM SKIP: Skipping DKIM checks for
>> whitelisted domain: $sender_address_domain
>>                 set acl_m2 = 1

>>         #
>>         # skip DKIM checks on hosts we relay for
>>         #
>>         accept  hosts = +relay_from_hosts
>>                 logwrite = DKIM SKIP: Skipping DKIM checks for relay
>> host: $sender_fullhost

>>         #
>>         # skip DKIM checks on authenticated hosts (that we also relay for)
>>         #
>>         accept  authenticated = *
>>                 logwrite = DKIM SKIP: Skipping DKIM checks for
>> authenticated host: $sender_fullhost

>>         #
>>         # defer when message not testable, e.g. can't get public key, etc.
>>         #
>>         defer   dkim_status = invalid
>>                 message = Message from $sender_address_domain cannot be
>> verified
>>                 logwrite = DKIM DEFER: domain=$sender_address_domain

>>         #
>>         # accept the message (correctly signed)
>>         #
>>         accept  dkim_status = pass
>>                 sender_domains = $sender_address_domain
>>                 dkim_signers = $sender_address_domain
>>                 logwrite = DKIM PASS: domain=$sender_address_domain
>> signer=$dkim_cur_signer status=$dkim_verify_status
>>                 add_header = :after_received:X-DKIM-Result:
>> Domain=$sender_address_domain Result=Signature OK

>>         #
>>         # accept the message EVEN IF the signature FAILS! due to white
>> listing
>>         #
>>         accept  condition = ${if eq {$acl_m2}{1}}
>>                 dkim_status = fail
>>                 sender_domains = $sender_address_domain
>>                 dkim_signers = $sender_address_domain
>>                 logwrite = DKIM FAIL (WHITELISTED):
>> domain=$sender_address_domain status=$dkim_verify_status - DKIM failed
>> but message accepted
>>                 add_header = :after_received:X-DKIM-Result:
>> Domain=$sender_address_domain Result=FAIL (but whitelisted)

>>         #
>>         # deny (strict) when message fails signature test *and* acl_m2 =
>> 0 (not whitelisted)
>>         #
>>         deny    condition = ${if eq {$acl_m2}{0}}
>>                 dkim_status = fail
>>                 sender_domains = $sender_address_domain
>>                 dkim_signers = $sender_address_domain
>>                 message = Message from has invalid DKIM signature
>>                 logwrite = DKIM FAIL (DENY):
>> domain=$sender_address_domain - message rejected!

>>         #
>>         # accept anything else (should never get here)
>>         #
>>         accept  logwrite = DKIM DEFAULT: domain=$sender_address_domain -
>> message accepted (at end of ACL)

>>     http://www.protodave.com/tools/dkim-key-checker/