Skip to content

feat: Sign bounce messages#874

Draft
j-g00da wants to merge 1 commit intomainfrom
j-g00da/sign-bounce
Draft

feat: Sign bounce messages#874
j-g00da wants to merge 1 commit intomainfrom
j-g00da/sign-bounce

Conversation

@j-g00da
Copy link
Collaborator

@j-g00da j-g00da commented Feb 26, 2026

Closes #873

@j-g00da j-g00da temporarily deployed to staging2.testrun.org February 26, 2026 12:05 — with GitHub Actions Inactive
@j-g00da j-g00da temporarily deployed to staging-ipv4.testrun.org February 26, 2026 12:05 — with GitHub Actions Inactive
Copy link
Contributor

@missytake missytake left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think this approach would work, see my comment. In any case, this PR needs a test.


# We want to filter bounce messages, so that they are DKIM signed.
# filtermail MUST NOT reject any outgoing bounce messages.
internal_mail_filter_classes = bounce
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

According to man 5 postconf, this option defines What categories of Postfix-generated mail are subject to before-queue content inspection by non_smtpd_milters, header_checks and body_checks.

opendkim is running as an smtpd_milter, filtermail as an smtpd_proxy - so this would not be enough to pass the mail to them.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yup, I forgot to mark this as a draft! I only started to dig into that :)

@j-g00da j-g00da marked this pull request as draft February 26, 2026 15:39
@j-g00da j-g00da force-pushed the j-g00da/sign-bounce branch from 2e2e6cd to 0bfc671 Compare March 2, 2026 11:06
@j-g00da j-g00da force-pushed the j-g00da/sign-bounce branch from 0bfc671 to ada0060 Compare March 2, 2026 11:34
@j-g00da j-g00da force-pushed the j-g00da/sign-bounce branch from ada0060 to 9dac959 Compare March 2, 2026 11:40
@j-g00da j-g00da force-pushed the j-g00da/sign-bounce branch from 9dac959 to 43590d3 Compare March 3, 2026 09:56
@j-g00da j-g00da force-pushed the j-g00da/sign-bounce branch from 43590d3 to b197edf Compare March 3, 2026 10:38
@j-g00da j-g00da force-pushed the j-g00da/sign-bounce branch from b197edf to 726837f Compare March 3, 2026 11:11
@j-g00da j-g00da had a problem deploying to staging2.testrun.org March 3, 2026 11:54 — with GitHub Actions Error
@j-g00da j-g00da had a problem deploying to staging-ipv4.testrun.org March 3, 2026 11:54 — with GitHub Actions Error
@j-g00da j-g00da force-pushed the j-g00da/sign-bounce branch from ae0ef53 to 40ee20f Compare March 3, 2026 11:55
Closes #873

Signed-off-by: Jagoda Ślązak <jslazak@jslazak.com>
@j-g00da j-g00da force-pushed the j-g00da/sign-bounce branch from 40ee20f to d0d5635 Compare March 3, 2026 12:11
@j-g00da j-g00da requested a deployment to staging-ipv4.testrun.org March 3, 2026 12:11 — with GitHub Actions In progress
@j-g00da j-g00da requested a deployment to staging2.testrun.org March 3, 2026 12:11 — with GitHub Actions In progress
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bounce messages are not signed with DKIM

2 participants