Re: A lot of "invalid DKIM result" messages in my logs

On 2024-11-16 at 16:48:49 UTC-0500 (Sat, 16 Nov 2024 21:48:49 +0000)
Nick Howitt <[email protected]>
is rumored to have said:

> Hi,
>
> I am just going through my mail logs and I am seeing a lot of:
>
>    _WARN: plugin: eval failed: invalid DKIM result at
>    /usr/share/perl5/Mail/DMARC.pm line 107.

Context would help, e.g. the full log line showing what process sent 
that message.

> My set up is Debian 12 with their packaged amavis, postfix, 
> spamassassin, clamav and postfix-policyd-spf-python.

The specific version of SpamAssassin would help, although I understand 
Debian does do some backporting. SpamAssassin support was greatly 
enhanced with v4, so if Debian 12 is still shipping a v3.4.x variant 
that might be relevant.

There's nothing I see in the current version of Mail::DMARC around that 
line number that could trigger that message, so an update to that Perl 
module *may* be in order.

> Should I be concerned and what can I do about it?

I suspect that this is due to messages with Authentication-Results 
headers that don't have DKIM fields, such as the messages from this list 
which have a header like this:

    Authentication-Results: apache.org; auth=none

If that is the underlying cause, it is entirely harmless. You may want 
to verify that legitimate messages are matching DKIM and DMARC 
SpamAssassin rules to be sure.

It is possible that this is actually a bug in Mail::DMARC. The lack of a 
DKIM value in an A-R header probably should not generate a warning.


-- 
Bill Cole
[email protected] or [email protected]
(AKA @[email protected] and many *@billmail.scconsult.com 
addresses)
Not Currently Available For Hire