Re: ezmlm-idx and DomainKeys

I use DomainKeys on all my lists (and all my mail ...my DNS record 
says ALL messages from me should be signed).  I'll try to cover all 
the necessary points.

I think the DK standard discusses deciding which signature to use if 
a message contains more than one, so it may not be necessary to strip 
DomainKey-Signature and Sender from incoming messages.  But I thought 
it would be cleaner and less confusing to do that.  I use headerkeep 
instead of headerremove (thanks for adding that feature!), and 
DomainKey-Signature and Sender are not in my keep list.  I add a 
Sender in headeradd.  I don't think it matters what address you use 
as long as the domain is right.  I use something like
Sender: List Name <[email protected]>

I saw Charles' note about Resent-Sender.  I don't know whether that 
would work, but I just didn't see any reason to keep the incoming 
sender.

I sign messages with a modified version of Russ Nelson's qmail-dk. 
My qmail is patched with John Simpson's combined patch which includes 
support for the QMAILQUEUE environment variable to provide a 
qmail-queue front end.  If your qmail doesn't have QMAILQUEUE support 
(also available in various other patches), there are other ways to 
front-end qmail-queue.  But I really recommend the jms patch; it has 
a lot of other stuff that you need in today's environment.
http://qmail.jms1.net/

If you use the qmail-verh patch to customize your outgoing list 
messages, it can invalidate a signature added when the message was 
queued.  I discussed this problem recently in response to somebody's 
query on this list: "To VERH or not to VERH?"  See my response at
http://marc2.theaimsgroup.com/?l=ezmlm&m=116930667316131&w=2
I won't bother to repeat it here, except to say that I opted to use 
the modified qmail-dk.

Since my signature process depends on environment variables, they 
need to be set in the list .qmail files for any command that might 
send mail.  For example
|env QMAILQUEUE=/var/qmail/bin/qmail-dk 
DKEXCLUDEHEADERS=List-Unsubscribe /usr/local/bin/ezmlm-send  listdir

I think that covers everything I had to do to get Domainkeys working. 
For somebody who is completely new to domainkeys, you'll need to set 
up the necessary key files and DNS records.  But hopefully you've 
gotten all that stuff working before you get brave enough to start 
using it on your lists.

One additional note, not specifically related to domainkeys.  If 
you're using verh, as I am, and you decide to use the jms1 patch, as 
I do and recommend, it does not include the verh patch.  That's about 
the only thing that keeps it from being perfect.  (I don't think the 
author uses ezmlm, and I couldn't convince him verh was wonderful). 
You'll need to futz with the verh patch a little to get it to install 
on top of the jms1 patch, but that's not very difficult.  I actually 
combined them into one patch,  and I'm not a wizard at this stuff so 
anybody should be able to do it.