Re: [AMaViS-user] amavis and dkim with postfix

[Mark M. <Mar...@ij...>]

Christian,

> I followed the documentation at
> http://www.ijs.si/software/amavisd/amavisd-new-docs.html
> on Ubuntu Hardy Heron 8.04. Everything is working so far. But I really
> did not understand everything I could read there about the DKIM setup.

I haven't yet updated that section to go along with 2.6.0, which now
implements DKIM signing and validation internally, dropping a need
to run dkim as milters. But if one prefers dkim-milter, that docs
is still valid, even with 2.6.0.

> Did I understand this correctly that dkim is running as a milter as well
> as a perl module inside spamassassin? So is it really running twice for
> every incoming mail?

Yes, it is true (unfortunately). Depending on one's needs, one or
the other may be left out: DKIM as a SpamAssassin plugin takes care
of DKIM-based whitelisting and blacklisting;  DKIM in a verifying
milter is mostly interesting for testing / double-checking, as it
adds a header field with its results. Note that SpamAssassin does not
see every mail, e.g. large mail and infected mail is not passed to SA.

As for signing, DKIM plugin in SpamAssassin can not provide it.
For signing one needs either a signing dkim milter, or amavisd-new-2.6.0
which does it by itself (using module Mail::DKIM, the same module as
used by SpamAssassin DKIM plugin).

Still, it is not too bad to run DKIM verification twice. The DNS lookup
is cached by a DNS server so normally only one query is sent out. And
signature processing it quite fast, so compared to the rest of what
SpamAssassin is doing, the extra time spent is rather negligible.

> Could someone please explain me what is the need for the C-version in
> master.cf and the perl-version in SA? Do I really need both or is the
> SA-version enough?
>
> dkim-filter        2.5.4.dfsg-0ubuntu2
> libmail-dkim-perl    0.28-2
> spamassassin        3.2.4-1ubuntu1
> amavisd-new        1:2.5.3-1ubuntu3
>
> If there is no need for both instances (C and perl), please let me know.
> Thanks in advance.

If you stay with amavisd-new-2.5.* you need both, assuming you want
to do DKIM signing too (only provided by a milter).

If you switch to amavisd-new-2.6.0, you can drop dkim-filter.

I don't know what libmail-dkim-perl is - probably a package with a perl
module Mail::DKIM - yes, you need it to let SpamAssassin do its DKIM stuff
and you need it to let amavisd-new-2.6.0 do its DKIM signing and verification
(if enabled). The current version of Mail::DKIM is 0.31, compared to 0.28 it
is significanly faster (by a factor of 8 on large mail!), not to mention
that it fixes some bugs.

  Mark