search

apache / incubator-ponymail-foal

Apache Pony Mail Foal (Next Generation Suite)
https://ponymail.apache.org
Apache License 2.0
27 stars 14 forks source link

DKIM-ID is incompatible with stdin mode archiving #44

Open sbp opened 3 years ago

sbp commented 3 years ago

The DKIM-ID generator has diminished functionality when archiver.py is used in stdin mode because the DKIM-ID generator relies on headers such as List-Id which are added by the mailing list manager. If archiver.py is used in stdin mode then it typically receives an email before the mailing list manager has added the List-Id and other such headers, and before it may have made any of the other DKIM changes listed in RFC 6377 § 3.3.

In consequence, archiver.py is only compatible with the Mailman3 mailing list manager. If it is used with any other mailing list manager then it has to be used in stdin mode, which means that messages sent out by the mailing list manager will not match the DKIM-ID of the message as stored in the mailing list archive. Though DKIM-ID will still function as a deduplicator in this case, it will not be possible to use it to search for existing messages or to recover lost messages.

Possible actions that could be taken include either removing the ability to archive using stdin mode, or noting in the documentation the loss of functionality when using DKIM-ID in conjunction with stdin mode. It may also be possible to set up some mailing list managers to send their outgoing messages through an MTA filter which sends a copy to the archiver in stdin mode. If so, this could be documented as another potential option.

Humbedooh commented 3 years ago

If archiver.py is used in stdin mode then it typically receives an email before the mailing list manager has added the List-Id and other such headers, and before it may have made any of the other DKIM changes listed in RFC 6377 § 3.3.

What leads you to believe this? From what I can tell, from experience, the vast majority of use cases out in the wild, probably 9 out of 10, are using stdin mode for archiving by subscribing the archiver as a standard consumer. In such cases, it would get the emails with the final headers appended/munged, and there would be no problem. In which cases are you seeing otherwise?

I can see the argument that we perhaps should note that the place we hook into the email infrastructure can have a say on the ID consistency, but I don't see this as a very common case.

sbp commented 3 years ago

Archiving a message before it reaches the mailing list manager means that the original DKIM signature is preserved. In other words it's a way of preventing the kind of modifications described in RFC 6377 § 3.3 from breaking the actual DKIM signature (unrelated to the DKIM-ID) in archived messages, when desired. But it is more complicated to set up.

Just documenting the effects does indeed sound like the best solution.