dkim=fail (2048-bit key) reason="fail (message has been altered)"

[sarsenal]

We keep getting phishing emails. I see they fail dkim. How can I block them on PMG?

 

[dcsapak]

can you post the log from such a mail? AFAIR there is a spamassassin rule when DKIM fails, which you could increase the score of (so that it get's marked as spam)

 

[sarsenal]

Where are the logs stored for spamassassin that has the details? The tracking center log for the email doesn't show what the headers show. It has no details for dkim just that it is (0.1). I would post logs from spamassassin if I knew where they are.

Tracking Center for the email has SA of:
SA score=0/5 time=12.334 bayes=0.00 autolearn=no autolearn_force=no hits=BAYES_00(-1.9),DKIM_INVALID(0.1),DKIM_SIGNED(0.1),HTML_MESSAGE(0.001),HTML_TAG_BALANCE_BODY(0.1),KAM_DMARC_STATUS(0.01),KAM_HTMLNOISE(1),MISSING_MID(0.497),SPF_HELO_PASS(-0.001),SPF_PASS(-0.001),T_HTML_ATTACH(0.01)

dkim=fail (2048-bit key) reason="fail (message has been altered)​

This is what is in the header of the email:
Authentication-Results: mail.server.com (amavisd-new);
dkim=fail (2048-bit key) reason="fail (message has been altered)"
header.d=phishing_domain.com

I already have custom rules that block other emails based on patterns. If it is easy enough to have spamassassin block, can I match based on the dkim field and set the score to 10.

 

[dcsapak]

DKIM_INVALID(0.1)

you could increase the weight of this rule if that's what you want

also:

BAYES_00(-1.9)

i'd recommend turning off bayes, the message wouldn't have been assigned many points, but it would have had at least a spamscore of 1

 

[sarsenal]

Where do I change the weight of DKIM_INVALID?

By turning off BAYES_00 you mean bayesian filter in Spam detector configuration? That was on by default I think. Do I lose anything by turning it off? Will more valid emails hit spam due to this change? So far we don't have any valid emails hitting spam. So trying to find the right balance when making changes.

Thanks again

 

[dcsapak]

Where do I change the weight of DKIM_INVALID?

configuration -> Spam detector -> custom scores, see https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#pmgconfig_spamdetector_customscores

By turning off BAYES_00 you mean bayesian filter in Spam detector configuration? That was on by default I think. Do I lose anything by turning it off? Will more valid emails hit spam due to this change? So far we don't have any valid emails hitting spam. So trying to find the right balance when making changes.

in our experience, bayes in it's default configuration (so without manually feeding it data) it does not really help much, so we generally recommend it being turned off (AFAIR we do want to change the default to off sometime in the future)