To quarantine the flood of marketing junkmail, using a backstop rule at the very bottom of the priority that matches header fields for all the various marketing automation systems has been very successful. Basically, a large set of "</> Match Field" entries like so:
X-Mailgun-Sid=.+
X-SG-EID=.+
X-MarketoID=.+
X-MC-User=.+
and on and on. I have a pretty decent library of these now.
There are, unfortunately, some legitimate companies who use these same mail automation services to send normal email. Whitelisting those companies' domains does not work because the domain is the or one of the generic domains used by the marketing automation services. I have found a fairly nice way around this by placing a "DKIM Whitelist" near the standard whitelist in priority. Again, these are "</> Match Field" entries, but they look like this:
DKIM-Signature=d=example\.com;
This works very well, but I can hypothesize a way to circumvent this: an invalid DKIM with the appropriate d field would be delivered via the DKIM whitelist, so this is more of a "poor man's" DKIM whitelist.
Is there a way to do something like the above, but only operate on validated DKIM signatures that have been found valid?
X-Mailgun-Sid=.+
X-SG-EID=.+
X-MarketoID=.+
X-MC-User=.+
and on and on. I have a pretty decent library of these now.
There are, unfortunately, some legitimate companies who use these same mail automation services to send normal email. Whitelisting those companies' domains does not work because the domain is the or one of the generic domains used by the marketing automation services. I have found a fairly nice way around this by placing a "DKIM Whitelist" near the standard whitelist in priority. Again, these are "</> Match Field" entries, but they look like this:
DKIM-Signature=d=example\.com;
This works very well, but I can hypothesize a way to circumvent this: an invalid DKIM with the appropriate d field would be delivered via the DKIM whitelist, so this is more of a "poor man's" DKIM whitelist.
Is there a way to do something like the above, but only operate on validated DKIM signatures that have been found valid?