[pfx] Re: Dynamic content filter allows for forged mails to be signed with DKIM

Hi Matus,

Thanks for your message!

On 8/13/26 16:39, Matus UHLAR - fantomas via Postfix-users wrote:
> On 13.08.26 15:48, Peymaneh Nejad via Postfix-users wrote:
>> main.cf:
>> ```
>> smtpd_recipient_restrictions =
>>    check_recipient_access hash:/etc/postfix/spamfilter_access,
>>    permit_mynetworks,
>>    permit_sasl_authenticated,
>>    reject_unauth_destination,
>>    check_policy_service unix:private/policy-spf
>> ```
>>
>> Where this is the content of /etc/postfix/spamfilter_access:
>> ```
>> [email protected]  FILTER spamassassin:
>> ...
>> ```
>>
>> Now it seems that this setups allows unauthenticated and forged mails from a 
>> nonexistent user via port 25 to be signed with a DKIM signature by us:
> 
> Neither of these calls opendkim

Sorry, I did not include that part of main.cf:
```
milter_default_action = accept
milter_protocol = 6
smtpd_milters =
     inet:127.0.0.1:12301 # opendkim
     inet:127.0.0.1:8893  # opendmarc
non_smtpd_milters = inet:localhost:12301
```

>> 2026-08-11T10:37:19.663155+02:00 mail postfix/pickup[3929985]: A1D22A40005: 
>> uid=131 from=<MAILER-DAEMON>
>> 2026-08-11T10:37:19.663913+02:00 mail postfix/pipe[520894]: 1ABE0A40002: 
>> to=<[email protected]>, orig_to=<[email protected]>, relay=spamassassin, 
>> delay=0.58, delays=0.18/0/0/0.4, dsn=2.0.0, status=sent (delivered via 
>> spamassassin service)
>> 2026-08-11T10:37:19.663974+02:00 mail postfix/qmgr[3958735]: 1ABE0A40002: removed
>> 2026-08-11T10:37:19.664835+02:00 mail postfix/cleanup[486649]: A1D22A40005: 
>> message-id=<[email protected]>
>> 2026-08-11T10:37:19.667515+02:00 mail opendkim[3959515]: A1D22A40005: DKIM- 
>> Signature field added (s=mail, d=example.org)
> 
> this seems to be your problem.
> SpamAssassin feeds the received mail to postfix via local service, so opendkim 
> thinks the mail originates locally.
> 
> 
> How do you call opendkim?
> Perhaps it could run as milter before FILTER catches?

See the snipped above on how we call OpenDKIM.

To me the https://www.postfix.org/FILTER_README.html suggests that the "FILTER" 
is a "after queue" filter action, is the current placement 
(smtpd_recipient_restriction) an issue?

> 
> And what does your spamassassin filter do?
It (currently) only has a very minimal config with a few blacklisted addresses 
and rewrites the header:
```
required_score 3.0

add_header spam Flag _YESNOCAPS_
add_header all Status _YESNO_, score=_SCORE_ required=_REQD_ tests=_TESTS_ 
autolearn=_AUTOLEARN_ version=_VERSION_

rewrite_header Subject [SPAM]

use_bayes 1
use_bayes_rules 1

use_pyzor 1
use_razor2 1

score RBL_SPAMHAUS_ZEN 3.0


blacklist_from [email protected]
blacklist_from ...
```

> Perhaps it could feed mail back to postfix on a port where opendkim does not run
Excuse me if this is an ignorant question, but would you know how to let 
spamassassin do that?

The postfix manpage states:
>        FILTER transport:destination
>               After the message is queued, send the entire message through the
>               specified  external content filter. The transport name specifies
>               the first field of a mail  delivery  agent  definition  in  mas-
>               ter.cf;  the  syntax of the next-hop destination is described in
>               the manual page  of  the  corresponding  delivery  agent.   More
>               information  about  external  content  filters is in the Postfix
>               FILTER_README file. 

The spamassassin documentation does not provide any hints on its 
usage/configuration as a "delivery agent"


Warm regards,
Peymaneh
_______________________________________________
Postfix-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]