pmg9 Receiving mails dkim always invalid

DHilleke

Member
Jul 6, 2023
4
1
8
I switched from pmg8 to pmg9.
Since then, spam levels have often been very high because all(?) DKIM signatures are declared invalid.
The emails are retrieved from the ionos mail server via fetchmail.
I don't believe that all signatures are incorrect.
How can I check this?
 
Please share the logs of such an email - and if possible also the headers or the complete email.
 
Return-Path: <20251027092237925ed15fcdfe449faddf6e416200p0eu-C3E3SNG5A5M7II@bounces.amazon.de>
Received: from mailgw9.suh.lan [192.168.1.85] by xxxxxxxxxx.de with david3 by Tobit.Software (0702.46484C4448464A4D4C50) (TLS (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256));
27 Oct 2025 09:26:28 UT
Received: from mailgw9.suh.lan (localhost [127.0.0.1])
by mailgw9.suh.lan (Proxmox) with ESMTP id 58DEB614FD
for <info@xxxxxxxxxx.de>; Mon, 27 Oct 2025 10:26:28 +0100 (CET)
Received: from mailgw9.suh.lan (mailgw9.suh.lan [192.168.1.85])
by mailgw9.suh.lan (Proxmox) with ESMTP id 569E3614FC
for <info@xxxxxxxxxx.de>; Mon, 27 Oct 2025 10:23:31 +0100 (CET)
Authentication-Results: kundenserver.de; dkim=pass header.i=@amazon.de
Authentication-Results: kundenserver.de; dkim=pass header.i=@amazonses.com
Received: from pop.ionos.de [212.227.15.171]
by mailgw9.suh.lan with POP3 (fetchmail-6.4.39)
for <info@xxxxxxxxxx.de> (single-drop); Mon, 27 Oct 2025 10:23:31 +0100 (CET)
Received: from a1-61.smtp-out.eu-west-1.amazonses.com ([54.240.1.61]) by
mx.kundenserver.de (mxeue103 [217.72.192.67]) with ESMTPS (Nemesis) id
1MkX0q-1uRZ9k3D2M-00mJP4 for <info@xxxxxxxxxx.de>; Mon, 27 Oct 2025
10:22:39 +0100
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;
s=oh3t3hujtzjgoyk4jpthyrvrimucwqwq; d=amazon.de; t=1761556958;
h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;
bh=1Li7a44j53/aXeAgLafALgQb65n2pGumICo1ipx1PrI=;
b=VL4ZrW8/CB8vv+oOQbJihEY/yPFlhm1UkCOziJlfbqx+ktyATsjvPirfe7oMPgBw
DTZloZ2AeaOBtXbC1EeIefqdbgfOt+cmpgQmQu+wtx82Bj0rOsV3G/uKLu4SsvsqM4t
r91v4XkHlmWhWMnLHePkJdvnDF9EAC4uEhs+gOIs=
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;
s=ihchhvubuqgjsxyuhssfvqohv7z3u4hn; d=amazonses.com; t=1761556958;
h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type:Feedback-ID;
bh=1Li7a44j53/aXeAgLafALgQb65n2pGumICo1ipx1PrI=;
b=URH9K3iOkrD2vPSV/kt2JHSmTRgnoK8gsy4LiNNTUvUO7T06A1SHj927AnRSqf1Z
daiUvGtvI9Xm/ipAlZtQkIgVW7bEFPrImAIxPNkwfWf3S97Tykqz5IvohfjBu1XzUUq
nawsCVOzecMms6VS1lKqeZMII2iKhC33vg3AuOEU=
Date: Mon, 27 Oct 2025 09:22:38 +0000
From: "Amazon.de" <bestellbestaetigung@amazon.de>
To: info@xxxxxxxxxx.de

subject is: Bestellt: „Labornetzteil, Jesverty...“
Message-ID: <0102019a24fa0bd5-9245f695-52eb-4cd8-844c-5f42ce740585-000000@eu-west-1.amazonses.com>
Subject: =?UTF-8?B?QmVzdGVsbHQ6IOKAnkxhYm9ybmV0enRlaWwsIEplc3ZlcnR5Li4u4oCc?=
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_Part_3719046_121975051.1761556958139"
X-AMAZON-MAIL-RELAY-TYPE: notification
Bounces-to: 20251027092237925ed15fcdfe449faddf6e416200p0eu-C3E3SNG5A5M7II@bounces.amazon.de
X-AMAZON-METADATA: CA=C3E3SNG5A5M7II-CU=A1XD65OI9ER2HF
X-Original-MessageID: <urn.rtn.msg.20251027092237925ed15fcdfe449faddf6e416200p0eu@1761556958140.>
Feedback-ID: 1111661321::1.eu-west-1.UIAUrMfbpGrxavqnRE0yoZrAUBI9C7GRNUx/kUDo6B4=:AmazonSES
X-SES-Outgoing: 2025.10.27-54.240.1.61
Envelope-To: <info@xxxxxxxxxx.de>
X-Spam-Flag: NO
UI-InboundReport: notjunk:1;M01:P0:HQeAH0KsZx4=;w2f
..........
X-SPAM-LEVEL: Spam detection results: 6
DKIM_INVALID 0.1 DKIM or DK signature exists, but is not valid
DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid
DMARC_QUAR 0.1 DMARC quarantine policy
GB_GEN_REDIR_URL 0.5 Redirector found in href link
HTML_FONT_SIZE_HUGE 0.001 HTML font size is huge
HTML_MESSAGE 0.001 HTML included in message
KAM_DMARC_QUARANTINE 4 DKIM has Failed or SPF has failed on the message and the domain has a DMARC quarantine policy
KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
LOTS_OF_MONEY 0.001 Huge... sums of money
RDNS_NONE 1.274 Delivered to internal network by a host with no rDNS
T_REMOTE_IMAGE 0.01 Message contains an external image
T_SPF_HELO_TEMPERROR 0.01 SPF: test of HELO record failed (temperror)
T_SPF_TEMPERROR 0.01 SPF: test of record failed (temperror)
 
T_REMOTE_IMAGE 0.01 Message contains an external image
T_SPF_HELO_TEMPERROR 0.01 SPF: test of HELO record failed (temperror)
T_SPF_TEMPERROR 0.01 SPF: test of record failed (temperror)
hm - funktioniert DNS für das PMG zuverlässig? - diese SpamAssassin hits kenne ich von fällen wo DNS ganz oder teilweise nicht geht.