Greetings, * William Herrin (bill@herrin.us) wrote:
On Wed, Nov 29, 2017 at 12:03 PM, Eric Kuhnke <eric.kuhnke@gmail.com> wrote:
For those who operate public facing SMTPd that receive a large volume of incoming traffic, and accordingly, a lot of spam...
How much weight do you put on an incoming message, in terms of adding additional score towards a possible value of spam, for total absence of DKIM signature?
Zero. DKIM for mailing lists is a horribly broken design and legitimate mailing lists are second only to spam in quantity of SMTP transactions.
Eh, that's really not accurate, imv, and some folks who run mailing lists have put in serious effort to make sure to *not* break DKIM signatures (which is certainly possible to do). The combination of making DKIM signatures work and DMARC allows messages to go through that would otherwise end up getting bounced, from what I've seen. What's annoying are the systems that appear to assume a DMARC policy that says "bounce it if it's not from a server in our SPF list" when there's no DMARC policy in place, but there is an SPF list. Not everyone really wants to put in the effort to set up DKIM, but they're fine putting up an SPF record, but there seem to be a number of servers out there that bounce mailing list traffic in those cases (seems to specifically be MS Exchange systems, from the google'ing that I've done). Thanks! Stephen