OpenARC is (according to Zoho) creating a bad signature on outbound email

pcolmer commented 2 years ago

I'm trying to get ARC set up on a Mailman 3 server. I'm using Postfix as the MTA and OpenDKIM for the DKIM piece. As ARC sealing needs to happen after signatures, I've installed OpenARC rather than using the functionality in Mailman 3 (since the latter would result in sealing before signatures).

I've been sending and receiving emails from a Zoho Mail mailbox, partly because that seems to give me clearer headers but the upshot is that Zoho claims that the ARC signature from OpenARC is invalid.

Received-SPF: pass (zohomail.com: domain of mm3.mailmanserver.org designates 1.2.3.4 as permitted sender) client-ip=1.2.3.4; envelope-from=test-bounces+philip.colmer=example.org@mm3.mailmanserver.org; helo=mm3.mailmanserver.org;
Date: Wed, 15 Sep 2021 09:19:00 +0100
To: "test" <test@mm3.mailmanserver.org>
Message-Id: <17be889a8f0.c600de7c81990.1652874657010482339@example.org>
MIME-Version: 1.0
Importance: Medium
User-Agent: Zoho Mail
Message-ID-Hash: PDMAYDKPKC2XYR5FXGPWHGP5DXMY7N4Y
Precedence: list
Subject: [Test] And testing after upgrading OpenARC code
Archived-At: <>
From: Philip Colmer via Test <test@mm3.mailmanserver.org>
Reply-To: Philip Colmer <philip.colmer@example.org>
Content-Type: multipart/mixed; boundary="===============3602031680822028497=="

I've changed domains and IP addresses.

In /etc/openarc.conf, I've defined:

AuthservID           mm3.mailmanserver.org
Canonicalization     relaxed/simple
Domain               mm3.mailmanserver.org
KeyFile              <path to file>
OversignHeaders      From
PidFile              <path to file>
Selector             mailman
Socket               <path to socket>
Syslog               yes

I mostly followed the instructions I found at https://weber.fi.eu.org/blog/Informatique/openarc_with_postfix_on_debian_10.html?lang=en so I'm not sure if items like OversignHeaders are correct or not.

Edited to add:

Reading the man page for openarc.conf, I read this part for "OversignHeaders": "Note that listing a field name here and not listing it in the SignHeaders list is likely to generate invalid signatures." Since I wasn't defining anything for "SignHeaders", I've commented out the definition for "OversignHeaders", restarted OpenARC and sent another test. Unfortunately, Zoho still reports a "Bad Signature".

Edited: I've switched to the develop branch of OpenARC and incorporated the changes from https://github.com/trusteddomainproject/OpenARC/pull/145, https://github.com/trusteddomainproject/OpenARC/pull/141 and https://github.com/trusteddomainproject/OpenARC/pull/121. I've updated the headers above to reflect a test performed after changing the OpenARC code. Unfortunately, Zoho still says the signature is bad.

Edited: I've tried explicitly setting SignHeaders (to SignHeaders to,subject,message-id,date,from,mime-version,dkim-signature,arc-authentication-results) but that didn't help either.

rdemendoza commented 2 years ago

+1

abeverley commented 7 months ago

I'm also finding the same with Outlook.com. I've tried all the patches I can find, and it's still showing an ARC fail.

abeverley commented 7 months ago

Just to add that I've also just tried with Zoho, and that appears to be showing valid ARC signatures. That's with my locally-patched version of OpenARC though, so it's possible I've applied something that fixes the original problem.

@pcolmer @rdemendoza - are you still having problems with Zoho?

trusteddomainproject / OpenARC

OpenARC is (according to Zoho) creating a bad signature on outbound email #149