Smart Host (ARC) and Mime Attachment Breaks DKIM.
Using smart host and ARC, spam scan tampers with the headers breaking BH.
Any reliable solution to detect smart host forwarded to skip spam scan in this scenario?
-
Hey hey! Can you let me know what "BH" means in this context?
I would need to know a bit more about how you are forwarding messages and your your smart host is configured before I could make any recommendations, as it's not clear to me where this forwarding is happening.
0 -
Body Hash,
So this is probably not my suggested setup, however, this is how one of my client flow is happening.
External(customer:gmail) > whm(spam assassin enabled - forwarded email) > proxmox > (gmail)
Using ARC at the moment, the body hash breaks as WHM adds and removes spam headers.
In EXIM, I disabled default_spam_scan.
Enabled custom_begin_spam_scan
```warn
# Remove spam headers from outside sources
condition = ${perl{spamd_is_available}}
condition = ${if or { \
{def:h_ARC-Seal:} \
{match_domain{$dkim_cur_signer}{gmail.com:yahoo.com:hotmail.com:outlook.com:icloud.com}} \
}{0}{1}}
!hosts = +skipsmtpcheck_hosts
remove_header = x-spam-subject : x-spam-status : x-spam-score : x-spam-bar : x-spam-report : x-spam-flag : x-ham-reportwarn
condition = ${perl{spamd_is_available}}
condition = ${if or { \
{def:h_ARC-Seal:} \
{match_domain{$dkim_cur_signer}{gmail.com:yahoo.com:hotmail.com:outlook.com:icloud.com}} \
}{0}{1}}
condition = ${if eq {${acl_m0}}{1}{1}{0}}
spam = ${acl_m1}/defer_ok
# Always make sure cPanel support mail can get through
!hosts = : +trustedmailhosts : +cpanel_mail_netblocks
log_message = "SpamAssassin as ${acl_m1} detected message as spam ($spam_score)"
add_header = X-Spam-Subject: ***SPAM*** $rh_subject
add_header = X-Spam-Status: Yes, score=$spam_score
add_header = X-Spam-Score: $spam_score_int
add_header = X-Spam-Bar: $spam_bar
add_header = X-Spam-Report: ${sg{${from_utf8:${sg{$spam_report}{\N\n \n\N}{\n}}}}{[[:^ascii:]]}{_}}
add_header = X-Spam-Flag: YES
set acl_m2 = 1warn
condition = ${perl{spamd_is_available}}
condition = ${if eq {$spam_score_int}{}{0}{${if <= {${spam_score_int}}{8000}{${if >= {${spam_score_int}}{50}{${perl{store_spam}{$sender_host_address}{$spam_score}}}{0}}}{0}}}}warn
condition = ${perl{spamd_is_available}}
condition = ${if or { \
{def:h_ARC-Seal:} \
{match_domain{$dkim_cur_signer}{gmail.com:yahoo.com:hotmail.com:outlook.com:icloud.com}} \
}{0}{1}}
condition = ${if eq {${acl_m0}}{1}{${if eq {${acl_m2}}{1}{0}{1}}}{0}}
add_header = X-Spam-Status: No, score=$spam_score
add_header = X-Spam-Score: $spam_score_int
add_header = X-Spam-Bar: $spam_bar
add_header = X-Ham-Report: ${sg{${from_utf8:${sg{$spam_report}{\N\n \n\N}{\n}}}}{[[:^ascii:]]}{_}}
add_header = X-Spam-Flag: NO
log_message = "SpamAssassin as ${acl_m1} detected message as NOT spam ($spam_score)"```
condition = ${if or { \
{def:h_ARC-Seal:} \
{match_domain{$dkim_cur_signer}{gmail.com:yahoo.com:hotmail.com:outlook.com:icloud.com}} \
}{0}{1}}
Probably not the best way, this was going to be an or/and statement.
POSTMAILCOUNT
send_via_smart_host:
driver = manualroute
domains = !+local_domains
transport = smart_host_smtp
route_list = * [reacted]
TRANSPORTSTART
smart_host_smtp:
driver = smtp
interface = <; %CPANEL-smtp-interface%
helo_data = %CPANEL-helo-data%
hosts_try_chunking = 198.51.100.1
message_linelength_limit = 20480 -
I think a better way to look at this would be to compare the headers from a system with and without ARC. Do you have some data showing what that looks like in the headers?
0 -
Its okay I figured out the issue.
So I was able to get the setup working.
This is what I was trying to fix.
Gmail email comes into WHM. WHM is now forwarding to Proxmox Mail Gateway which then uses ARC and SRS and goes back out to gmail.
So I was able to get this setup to work modifying some transport and then using openarc and postsrsd. SPF, DKIM, DMARC, ARC valid and verified end to end.
The issue is something I figured is a limitation, apparently for quite sometime and I don't think there's a fix for it.
So this flow breaks as soon as attachments are introduced, when attachments are introduced, DKIM is broken, so ARC is broken and the whole email is bounced. The issue occurs mainly with large providers where the initial email provider domain is also final email provider, same or different accounts. Microsoft and other providers seem to be abit more tolerant, gmail seems to be the biggest issue.
To get it to this point incase anyone is wondering, I did have to strip down the spam reporting and change the forwarders to not send DKIM on forwarded domains as the default settings kept adding in DKIM when it's not suppose to. I also had to remove EXIM adding in extra headers which cleaned up the header mismatch for ARC.0 -
I'm glad you were able to come up with a good solution!
0 -
There's no solution, don't think it's solvable, solution is to contact the clients to stop using forwarders.
0 -
cPRex I think ARC really needs to be looked into properly, this is going to be a big issue once gmail completely switches off POP3.
So the issue is this:
Gmail(external user)
ARC is required to verify
Email modification
ARC will sign and seal
Delivery to email server or smart host or external.
At the moment ARC signs and seals the email only, so this works for internal emails as there's nothing to verify, however, for forwarded emails, this doesn't work as ARC is required to verify the orginal email before any modification is taken place.
SRS doesn't work in this case, as many providers will still compare the sender domain and reject it as unauthorised as the origin IP would resolve to the sending server. Virus and spam scanners will change the body hash of the message, more importantly when there's an attachment, DKIM would not pass, so gmail will reject it, microsoft is abit more lenient, Outlook itself if not under a business domain will also reject the email.0 -
All good I got ARC to start verifying on cPanel, this should have been already part of the experiment arc toggle as signing alone is insufficient, might have been a slight oversight.
0 -
Can you let me know what adjustments you made to get things working how you like?
0 -
custom_begin_check_message_pre
.ifdef ARCSIGNING
warn
verify = arc/none:pass:failwarn
add_header = :at_start:${authresults {${primary_hostname}}}
.endif
This is what you guys are missing to get cv=pass fail none working and make ARC work.0 -
Also to note I did remove previous auth header that was added within the auth stage. It's not wrong, but inconsistent flow to have it.
As you need a clean chain of trust. So in between this you would add a remove_header Auth Result to the primary. domain.
0 -
Since this is closely related to the other thread at https://support.cpanel.net/hc/en-us/community/posts/38867359245975-ARC-CV-none I'm going to wait until I hear back about that before I take any action here.
0 -
In theory, I've been told this is resolved in version 136, which hasn't been released yet, but the fix is included in all versions. Once that version is released I would expect the signing to work without modifying the headers in a way that is causing your issue.
If you still this problem once version 136 is released it would be best to create a ticket so our team can evaluate this directly on your system.
0
Please sign in to leave a comment.
Comments
13 comments