#170 DKIM failure contrary to the RFC spec
The logic for DMARCok incorrectly associates failure of SPF or DKIM as failed DMARC
Case 1
SPF is valid but fails alignment, DKIM is valid and passes alignment yields a failed DMARC when it should not
Case 2
SPF passes alignment, DKIM does not yields a failed DMARC when it should not.
According to the RFC only one of these needs to pass regardless of the other setting.
https://www.rfc-editor.org/rfc/rfc9989.html#section-5.3.5
"If one or more of the Authenticated Identifiers align with the Author Domain, the message is considered to pass the DMARC mechanism check."
in the logic it forces BOTH to pass if they are set to strict.
This becomes important when organizations are using a third party system to send mail on their behalf and have implemented DKIM to authorize the email from those servers. This is common in ticketing and customer service saas systems.
at line 34993-4
return 1 if ($failed->{spf} eq 'pass' && $this->{dmarc}->{adkim} ne 's');
return 1 if ($failed->{dkim} eq 'pass' && $this->{dmarc}->{aspf} ne 's');
The ne 's' qualification prevents a pass where it should pass.
those lines should read IMHO
return 1 if ($failed->{spf} eq 'pass' );
return 1 if ($failed->{dkim} eq 'pass' );
Yes, assp forces a more strict policy than stated in the RFC 9989 (old 7489), if strict mode is defined in dmarc policy of the author.
Possibly assp will get a config option in a future release ('RFC conform' , 'more strict').
Thomas
It may be possible, that a third party system will be unable to create a valid DKIM signature (you would have to off hand your privat key) - but there is no reason why a SPF check should fail in such a case.
Thomas