Administrivia: exim.org DNS glitch, list unsubscribes

--===============1354680190==
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="8GpibOaaTibBMecb"
Content-Disposition: inline


--8GpibOaaTibBMecb
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Folks,

TL;DR: software bug, you might be unsubscribed from Exim mailing-lists,
(especially if you use SpamAssassin), please check and re-enable your
subscriptions.

A number of people have been automatically unsubscribed from the
exim-users mailing-list, because their mail-systems were rejecting
legitimate mail.  Upon investigation, SpamAssassin was scoring badly for
a DKIM signature made with a key "missing" from DNS.

Further investigation revealed a bug with the tool used for signing DNS
zones, such that on each signing, two (apparently) random records in the
zone had bad signatures and would "disappear" from DNS for those with
validating resolvers.  The latest automatic re-signing had happened to
hit the DKIM key d201705._domainkey.exim.org, such that although it
existed in DNS and had worked at the time of DKIM rollover, the latest
time-based re-signing of the zone "removed" it.

The "exim.org" zone is re-signed three times a month, in addition to
when any changes were made, so this breakage was introduced on June 1st.

Installing a newer version of the DNSSEC signing tool from upstream
source has resolved the issue.  I have filed a bug-report for the OS
package.  The validation tool I've found which catches this is great,
but the version packaged by the OS can't handle our zonefile, so I'll
see about installing a newer version of _that_, so that we can
automatically check and catch this in future instead of putting live bad
data.

Mail going out once more has a DKIM key visible in DNS, even to those
validating DNSSEC, so you should be safe to re-enable your subscriptions
if you so desire.

Apologies for the inconvenience,
-Phil

--8GpibOaaTibBMecb
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQROXBeef/xNv45sEy9REE5mjdBEgQUCWTTDgwAKCRBREE5mjdBE
gUOvAQCtHMSTlg7HfnjFo4WG4PlYYOPvGHsR1g8gE7yxWM1zmwEA7URdaWwgeul4
hX+JhjvAGLKfWzJyfnRjjkj6FvdZEgqJAjMEAQEIAB0WIQTGk6A04e1u6VTK4toT
2tmcfkFRnAUCWTTDgwAKCRAT2tmcfkFRnHBXD/4hW8hW9OJjxLpXNa9nwzy4rbYV
1E6WSVxoW5l0ezI2DCiQzqv8bvgGJ/aNzZlQ/BxnG9IxWpGis0ruNQ6ZIoiZmdz0
67Z1e1DvA9HhPi8J6wNS+WHfSdiF/yLnFlZDpfN1gMx3CbUHgtjzzGpLBZzzrbb1
4j8Q6YC/lEpJlQyV5r02bnJI4nKP6M9PJgf86LV2WjCBX04tA+DQ7ly+54O7HyX8
0JPiCNpj7aejB7z6qH7bs7TiPOs4+ok8qmTDJdf709mrYjn2ciqv3W+LayhGsWwy
bkFkk+JWjXtZACH+fs68aJptrwHHRJ53uQ/LxOTdhG2q7vzEwuWKIhPttKybQWhJ
FMbln4xWUkbLouAxqGE+ZYYvNmF08vE6d1u01KhbXdz/QPI8OiAV0AAvF1Otsv8w
d2Qd0QGv6yoIgWk+nHYHQMBJZZOeocC84uK2DrXyByBEIV2mCQooBXOM7tc2LFvi
SnjKVmPzIRuhLi9Cf8vD4lbVxTu+UC4ZB4w3AxnOGel4xTAbp388OgnIJSGFaM8K
raLwYz4w0/6mMBO9tPln1AyVgPn8gS5mJlIU3NqXyu1laA7xK/l7U7mAmVp4aVar
ODUuRjl6cqqdr/EjhmbiG9iF0R7ETDtu9b5cCzep1z/UNwHgKWDux4nmOdE1z4/u
J/tk/UT6yryIYzS12g==
=hH2i
-----END PGP SIGNATURE-----

--8GpibOaaTibBMecb--


--===============1354680190==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
## List details at https://lists.exim.org/mailman/listinfo/exim-announce Exim details at http://www.exim.org/ ##

--===============1354680190==--