Re: gbWilly all your mails are spam?

[Christof Thalhofer <chrisml@xxxxxxxxxxx>]

Am 27.12.24 um 14:41 schrieb Bruce Steers:

> gbWilly, what have you done that has every message from you going into 
> my spam folder?

I guess (but I am not sure) that is because protonmail.com creates a 
special DKIM signature in the header of a mail like this:

> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=protonmail.com;
> 	s=protonmail3; t=1734868471; x=1735127671;
> 	bh=U4nfEZorMAUdfPRtfY0QN2V4NZJ0NOygMoCwELfETgs=;
> 	h=Date:To:From:Cc:Subject:Message-ID:In-Reply-To:References:
> 	 Feedback-ID:From:To:Cc:Date:Subject:Reply-To:Feedback-ID:
> 	 Message-ID:BIMI-Selector:List-Unsubscribe:List-Unsubscribe-Post;
> 	b=o0JzR8A2fiKoHfsTuVgecr+qLbU7qbx8ob3EbiZ4XZe3C9k6lk0s77mON3xb3rHmt
> 	 29cyNh0ZtXvev540Tlx+DCIp2Z0BadICjOjYaxnF4rYXTAeq6Pvd1nKp9rf3Ei0mR/
> 	 +B25Smf5cYYp3nSQFiwrFj+h1y3n3KUQoMDNCUSnhbd8hrW7bgfMvTwD8KX/uKEkK2
> 	 raEAqOHSsEkvDBELzXmMtbxJU6B/F23NjbMFiMo+6z5nAF0YMkTh035ALykpdiB9bW
> 	 XNAOD2NjKDv7vicWP17NIqPC392Z3hRLqnlZ9/6lgLVttYT83PalH6spyz7+hUzjJC
> 	 SWQGRcsDQNehQ==

It includes within others the headers 
'List-Unsubscribe:List-Unsubscribe-Post' to create a cryptographic 
signature for that mail.

This is very unusual and counterproductive because these headers are 
usually set by a mailinglist software on another server after it 
received the original mail from a protonmail server and before it sends 
it out to the users.

In our case our software on lists.gambas-basic.org adds 
'List-Unsubscribe' to the headers and with that the first DKIM signature 
created by protonmail is broken.

A broken DKIM signature is a proof that strings in the defined headers 
and/or the body have been altered without the permission of the original 
sender or that the mail comes from another sender and pretends to be 
from the original one.

Receiving servers can ignore it or take it as a serious sign that the 
mail is spam.

Solution: Ask protonmail to remove 
'List-Unsubscribe:List-Unsubscribe-Post' from their DKIM signature.

Alles Gute

Christof Thalhofer

--
Dies ist keine Signatur