Skip to content

feat: use daemon_name for OpenDKIM sign-verify decision instead of IP#784

Merged
link2xt merged 1 commit intomainfrom
link2xt/opendkim-macros
Dec 19, 2025
Merged

feat: use daemon_name for OpenDKIM sign-verify decision instead of IP#784
link2xt merged 1 commit intomainfrom
link2xt/opendkim-macros

Conversation

@link2xt
Copy link
Copy Markdown
Contributor

@link2xt link2xt commented Dec 18, 2025

On FreeBSD 127.0.0.2 is not assigned to any interface by default,
so 127.0.0.2 source address hack cannot be used to make OpenDKIM
verify the signature instead of signing.

This change sets InternalHosts to - so no IP addresses
make OpenDKIM sign the message. Instead of IP address,
OpenDKIM in the outgoing pipeline is explicitly told
to sign messages by setting {daemon_name} macro to ORIGINATING.

This is a replacement for #778

@link2xt link2xt changed the title Link2xt/opendkim macros Use OpenDKIM macros instead of relying on 127.0.0.2 Dec 18, 2025
@link2xt
Copy link
Copy Markdown
Contributor Author

link2xt commented Dec 18, 2025

If this does not fail test_reject_missing_dkim then should be an alternative usable on FreeBSD.

I tested in #783 that the test works.

MTA ORIGINATING

# No hosts are treated as internal, ORIGINATING daemon name should be set explicitly.
InternalHosts -
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

-o smtpd_sender_restrictions=$mua_sender_restrictions
-o smtpd_recipient_restrictions=
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
-o milter_macro_daemon_name=ORIGINATING
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is unused because there is no milter.

-o smtpd_recipient_restrictions=
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
-o smtpd_client_connection_count_limit=1000
-o milter_macro_daemon_name=ORIGINATING
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was also unused, it's just a cleanup.

@link2xt
Copy link
Copy Markdown
Contributor Author

link2xt commented Dec 19, 2025

This is supposed to work: http://www.trusteddomain.org/pipermail/opendmarc-users/2013-June/000153.html

Here is the source code where {daemon_name} macro should be checked against MTA set and set originok to true:
https://github.com/trusteddomainproject/OpenDKIM/blob/5c539587561785a66c1f67f720f2fb741f320785/opendkim/opendkim.c#L11919-L11944

@link2xt
Copy link
Copy Markdown
Contributor Author

link2xt commented Dec 19, 2025

Seems the problem is that all the OUTGOING stuff works, but final.lua runs even for outgoing messages and this does not work anymore:

if odkim.internal_ip(ctx) == 1 then
-- Outgoing message will be signed,
-- no need to look for signatures.
return nil
end

We should not use internal_ip anymore.

@link2xt link2xt temporarily deployed to staging-ipv4.testrun.org December 19, 2025 03:14 — with GitHub Actions Inactive
@link2xt link2xt temporarily deployed to staging2.testrun.org December 19, 2025 03:14 — with GitHub Actions Inactive
@link2xt link2xt force-pushed the link2xt/opendkim-macros branch from 51a95c6 to 906c255 Compare December 19, 2025 03:34
@link2xt link2xt had a problem deploying to staging-ipv4.testrun.org December 19, 2025 03:34 — with GitHub Actions Error
On FreeBSD 127.0.0.2 is not assigned to any interface by default,
so 127.0.0.2 source address hack cannot be used to make OpenDKIM
verify the signature instead of signing.

This change sets InternalHosts to `-` so no IP addresses
make OpenDKIM sign the message. Instead of IP address,
OpenDKIM in the outgoing pipeline is explicitly told
to sign messages by setting `{daemon_name}` macro to `ORIGINATING`.
@link2xt link2xt force-pushed the link2xt/opendkim-macros branch from 906c255 to 34ce54a Compare December 19, 2025 03:34
@link2xt link2xt temporarily deployed to staging-ipv4.testrun.org December 19, 2025 03:34 — with GitHub Actions Inactive
@link2xt link2xt marked this pull request as ready for review December 19, 2025 03:35
@link2xt link2xt temporarily deployed to staging2.testrun.org December 19, 2025 03:36 — with GitHub Actions Inactive
@link2xt link2xt changed the title Use OpenDKIM macros instead of relying on 127.0.0.2 feat: use daemon_name for OpenDKIM sign-verify decision instead of IP Dec 19, 2025
@link2xt link2xt requested review from feld, hpk42 and missytake December 19, 2025 16:16
@link2xt link2xt merged commit 0d89027 into main Dec 19, 2025
6 of 7 checks passed
@link2xt link2xt deleted the link2xt/opendkim-macros branch December 19, 2025 17:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants