Dňa 14. októbra 2021 22:22:34 UTC používateľ Andy Bennett via Exim-users <exim-users@???> napísal:
>Is there any reason why the default settings are not optimal?
>
>...and how to choose between relaxed and strict modes?
I mean not optimal for me, of course.
By derault "the header names listed in RFC4871 will be used, whether or not each header is present in the message" (from docs). This is not always what one want, while still good choice as default. Some headers have to be oversigned, to cannot be added later (without invalidating signature), same will be oversigned, but only when they present in message and some will be signed, but allow to be added later (again without invalidating signature). The exim default nor provided macros fulfill this, thus i chose rspamd's way...
One mostly want relaxed, as simple (beware, not strict) can leads to unexpected results if message is "fixed" on the path, or to cite someone other:
The really simple takeaway is “use relaxed canonicalization”.
As relaxed is default, not need to care ;-)
The strict (aka dkim_strict) is not about signing, but about exim behavior, when signing fails. But it is about internal fail, not about not signing due empty domain, selector or key value. As my service is not mission critical, i leave default. If something goes bad, i will see it in DMARC reports.
Your needs/requirements can be different...
regards
--
Slavko
