ghost
commented
3 years ago Not a bug, use the forum for community support! Also issue template removed, that will be closed.
Closed CodeFetch closed 3 years ago
ghost
commented
3 years ago Not a bug, use the forum for community support! Also issue template removed, that will be closed.
CodeFetch
commented
3 years ago @mthld How do you know this is not a bug and why should I bother the forum people then if you know the reason?
CodeFetch
commented
3 years ago @mthld I've given it another try with dkimvalidator.com.
It says: Details: OpenSSL error: data too large for modulus
Sounds like a bug to me if Mailcow produces signatures causing such errors.
DKIM Information:
DKIM Signature
Message contains this DKIM Signature:
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ironai.com; s=dkim;
t=1623578030; h=from:subject:date:message-id:to:mime-version:content-type:
content-transfer-encoding; bh=g5z6HZxf3eLcT7ayvIrgw/KNB1+5Oe1d86xdMxtpe/o=;
b=vpOkzvj59H3A6423A9m5SNcgQW+iBHdBMnroNwvkJm1Hf6sDvtDR1f0Zfeczvkega/HR34
xS6lcpM2IAN3yEoz/SH6QAJb6jaAByKTasLPOhKAqfjUvHazIswdbdH2PPvk3jwZdtw4fU
H2sCfOyr08bgOerMvDzLG1eh/p+HXzyg5/86868PJV06oYI9YDykNfIB4UvQ9QGizzy5Iz
NpF5t618gdpe5DI854kyvksh1zwyG9eueBLVB0Cwd4O7ef2+kwODHyI9J0fdgEyga2I1Ia
e8hiddFV69w88PJ16GVR1C48gL34KCpnJxjh56KpB0VfbhLIkat0TAIs8q7Eqg==
Signature Information:
v= Version: 1
a= Algorithm: rsa-sha256
c= Method: relaxed/relaxed
d= Domain: ironai.com
s= Selector: dkim
q= Protocol:
bh= g5z6HZxf3eLcT7ayvIrgw/KNB1+5Oe1d86xdMxtpe/o=
h= Signed Headers: from:subject:date:message-id:to:mime-version:content-type:
content-transfer-encoding
b= Data: vpOkzvj59H3A6423A9m5SNcgQW+iBHdBMnroNwvkJm1Hf6sDvtDR1f0Zfeczvkega/HR34
xS6lcpM2IAN3yEoz/SH6QAJb6jaAByKTasLPOhKAqfjUvHazIswdbdH2PPvk3jwZdtw4fU
H2sCfOyr08bgOerMvDzLG1eh/p+HXzyg5/86868PJV06oYI9YDykNfIB4UvQ9QGizzy5Iz
NpF5t618gdpe5DI854kyvksh1zwyG9eueBLVB0Cwd4O7ef2+kwODHyI9J0fdgEyga2I1Ia
e8hiddFV69w88PJ16GVR1C48gL34KCpnJxjh56KpB0VfbhLIkat0TAIs8q7Eqg==
Public Key DNS Lookup
Building DNS Query for dkim._domainkey.ironai.com
Retrieved this publickey from DNS: v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsYrJcsC48aNjsOXRtztI6CSGGKFaeHifPcaP84g5jZm+ZWNvQ0qyLzKO4Ay9Y//0JTlm5vXr0KI40s4B7cuyAif98sPld0nVJfhK+v3nYvY/9Q0RGTBnA+SzGNlR2d9ZzN6M19umdF1NjffQ5ljAtE96VvG36TGkBIzGIDST+2SirPcFHzc2XfuU8piiMJGGmetaJicPL5Kc4ucv3qRff8sZnvB5XeRRz5MUafR3AFOi/aGgSxZ17QInSOBNUCiop/uLL2vsfbx/dB62ccLF2BUoQNAKPlZPCUcl2r5K9bAS8pnXOyeq+lRKCM9wDK+t9apstBjJSyilq6cFp6RB6wIDAQAB
Validating Signature
result = fail
Details: OpenSSL error: data too large for modulus
andryyy
commented
3 years ago Have you read the issue template? :)
Am 13.06.2021 um 11:50 schrieb Vincent Wiemann @.***>:
@mthld How do you know this is not a bug and why should I bother the forum people then if you know the reason?
— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or unsubscribe.
CodeFetch
commented
3 years ago @andryyy Yes, I have and I've mentioned all relevant information. I don't know which version of Mailcow it is. It is the Dockerized version and on the admin panel only lists the versions of components. My setup is standard on a barebone Debian 10 100% according to your tutorial. DNS entries and keys have been double-checked. Nothing I found relevant to mention here as this seems to be a signing issue.
acme-mailcow (mailcow/acme:1.78) (Started on 05/10/2021, 1:58:08 PM), Restart
dockerapi-mailcow (mailcow/dockerapi:1.38) (Started on 05/10/2021, 1:58:08 PM), Restart
dovecot-mailcow (mailcow/dovecot:1.141) (Started on 05/26/2021, 1:59:52 PM), Restart
ejabberd-mailcow (mailcow/ejabberd:1.4) (Started on 05/10/2021, 1:58:06 PM), Restart
ipv6nat-mailcow (robbertkl/ipv6nat) (Started on 06/13/2021, 3:11:51 AM), Restart
memcached-mailcow (memcached:alpine) (Started on 05/10/2021, 1:58:07 PM), Restart
mysql-mailcow (mariadb:10.4) (Started on 05/10/2021, 1:58:09 PM), Restart
netfilter-mailcow (mailcow/netfilter:1.39) (Started on 05/10/2021, 1:58:02 PM), Restart
nginx-mailcow (nginx:mainline-alpine) (Started on 05/10/2021, 1:58:07 PM), Restart
olefy-mailcow (mailcow/olefy:1.6) (Started on 05/10/2021, 1:58:06 PM), Restart
php-fpm-mailcow (mailcow/phpfpm:1.73) (Started on 05/10/2021, 1:58:08 PM), Restart
postfix-mailcow (mailcow/postfix:1.59) (Started on 05/26/2021, 2:00:01 PM), Restart
redis-mailcow (redis:5-alpine) (Started on 05/10/2021, 1:58:09 PM), Restart
rspamd-mailcow (mailcow/rspamd:1.76) (Started on 06/02/2021, 1:30:13 AM), Restart
sogo-mailcow (mailcow/sogo:1.95) (Started on 06/13/2021, 3:10:36 AM), Restart
unbound-mailcow (mailcow/unbound:1.13) (Started on 05/10/2021, 1:58:08 PM), Restart
watchdog-mailcow (mailcow/watchdog:1.90) (Started on 05/10/2021, 1:58:06 PM), RestartThere are also checkboxes etc.
We created the issue template for a reason, it sucks a lot when the rules are ignored. :(
Am 13.06.2021 um 12:20 schrieb Vincent Wiemann @.***>:
andryyy Yes, I have and I've mentioned all relevant information. I don't know which version of Mailcow it is. It is the Dockerized version and on the admin panel only lists the versions of components.
CodeFetch
commented
3 years ago I've added the template.
wblondel
commented
3 years ago This error "OpenSSL error: data too large for modulus" usually happens when you give a key bigger than what the distant server expects.
In your DNS zone, this 2048-bit DKIM key is configured:
v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsYrJcsC48aNjsOXRtztI6CSGGKFaeHifPcaP84g5jZm+ZWNvQ0qyLzKO4Ay9Y//0JTlm5vXr0KI40s4B7cuyAif98sPld0nVJfhK+v3nYvY/9Q0RGTBnA+SzGNlR2d9ZzN6M19umdF1NjffQ5ljAtE96VvG36TGkBIzGIDST+2SirPcFHzc2XfuU8piiMJGGmetaJicPL5Kc4ucv3qRff8sZnvB5XeRRz5MUafR3AFOi/aGgSxZ17QInSOBNUCiop/uLL2vsfbx/dB62ccLF2BUoQNAKPlZPCUcl2r5K9bAS8pnXOyeq+lRKCM9wDK+t9apstBjJSyilq6cFp6RB6wIDAQABMake sure it is the same one than the one shown here: https://{your mailcow host}/admin#tab-config-dkim
If they are the same, we will have to dig deeper :smile:
CodeFetch
commented
3 years ago @wblondel It is the same.
What I'm wondering about is this line:
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ironai.com; s=dkim;
I think it should be mx.bibbl.com (or better say where mailcow is running) as the SPF text entry in ironai.comv=spf1 mx a -all
allows the mx server to sign messages. mailcow just takes the domain name as it assumes that people have the A entry of all their mail domains set to the mailcow server... But I don't want that as I have web services running etc and a relay is no option.
wblondel
commented
3 years ago What is the configured hostname of your Mailcow instance? mx.bibbl.com or mail.ironai.com ?
Right now, the MX of ironai.com is mail.ironai.com, which points to 176.9.100.222.
However the PTR of this IP is mx.bibbl.com.
If mx.bibbl.com is indeed the configured hostname on your Mailcow server, first thing I would do is to remove the mail.ironai.com A record and put mx.bibbl.com as the domain MX.
I don't know if that will solve the problem you described, but at least it will remove one problem and help solving this one :smile:
github-actions[bot]
commented
3 years ago This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.
Prior to placing the issue, please check following: (fill out each checkbox with an
Xonce done)Summary
I'm running Mailcow on the subdomain mail.ironai.com. When ironai.com's A record is set to the same IP as the Mailcow server the DKIM signature is regarded valid, but when ironai.com is set to a different IP address it somehow fails. My suspicion is that the domain field of the DKIM signature should not be set to the email's domain, but to the mail server's.
I don't understand why the signature is reported wrong though as the body hash matches.
Logs
Will be added later. The log is so bloated that it takes an hour to output it into a file.
Reproduction
Writing emails to several DKIM test websites.
System information
docker version)docker-compose version)git diff origin/master, any other changes to the code? If so, please post them.iptables -L -vn,ip6tables -L -vn,iptables -L -vn -t natandip6tables -L -vn -t nat.docker exec -it $(docker ps -qf name=acme-mailcow) dig +short stackoverflow.com @172.22.1.254(set the IP accordingly, if you changed the internal mailcow network) and post the output.Here's a report: