Diagnose opendmarc fail message

[Kedarius]

I am evaluating docker mail server for a simple backup relay MX server.

I have a question about opendmarc. Ut failed a message, and I would like to find out exactly why:

mail.log:Jun  7 10:45:02 relay postfix/smtpd[235251]: 2E3D8220123: client=a11-47.smtp-out.amazonses.com[54.240.11.47]
mail.log:Jun  7 10:45:02 relay postfix/cleanup[235291]: 2E3D8220123: message-id=<0100018ff1df0e52-790af5c2-e06b-4811-b275-537ce3a9e7e2-000000@email.amazonses.com>
mail.log:Jun  7 10:45:02 relay opendkim[639]: 2E3D8220123: a11-47.smtp-out.amazonses.com [54.240.11.47] not internal
mail.log:Jun  7 10:45:02 relay opendkim[639]: 2E3D8220123: not authenticated
mail.log:Jun  7 10:45:07 relay opendkim[639]: 2E3D8220123: message has signatures from academia-mail.com, amazonses.com
mail.log:Jun  7 10:45:07 relay opendkim[639]: 2E3D8220123: DKIM verification successful
mail.log:Jun  7 10:45:07 relay opendkim[639]: 2E3D8220123: s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug d=amazonses.com a=rsa-sha256 SSL
mail.log:Jun  7 10:45:07 relay opendmarc[648]: 2E3D8220123: academia-mail.com fail
mail.log:Jun  7 10:45:07 relay postfix/cleanup[235291]: 2E3D8220123: milter-hold: END-OF-MESSAGE from a11-47.smtp-out.amazonses.com[54.240.11.47]: milter triggers HOLD action; from=<0100018ff1df0e52-790af5c2-e06b-4811-b275-537ce3a9e7e2-000000@amazonses.com> to=<[email protected]> proto=ESMTP helo=<a11-47.smtp-out.amazonses.com>

As far as I can read the log, it says DKIM is fine and then DMARC failed the message, but does not specify why? I feel like failing the message (effectively quarantining it) is worth a little more description of why.

I tried to see if there are any options available for opendmarc to increase its verbosity, but I could not find any.

My configuration is:

    environment:
      - ENABLE_SPAMASSASSIN=1
      - ENABLE_CLAMAV=1
      - ENABLE_FAIL2BAN=0
      - ENABLE_POSTGREY=0
      - ONE_DIR=1
      - DMS_DEBUG=0
      - ENABLE_POSTFIX_VIRTUAL_TRANSPORT=1
      - RELAY_HOST=upstream_server

To be more specific, I am not so much interested in this specific message, but if I would use docker mail server in production, I need to be able to provide my users with more information in cases like this. Or I can disable opendmarc and let the final MX solve it, but it seems like a good idea to process DMARC on the first incoming server.

[glime-ai[bot]]

Please note that this response was created using generative AI, leveraging previously available information from the repository. This information may be helpful. However, it is our strong recommendation that you carefully consider the information before blindly applying it.

This response is generated only once - you will not be able to interact with the glime-ai.

---

Para aumentar la verbosidad de OpenDMARC y obtener más detalles sobre por qué un mensaje falló, puedes ajustar la configuración de OpenDMARC. Aunque la documentación de Docker Mailserver no proporciona detalles específicos sobre cómo aumentar la verbosidad de OpenDMARC, puedes intentar modificar la configuración de OpenDMARC directamente.

Aquí hay algunos pasos que puedes seguir:

1. Modificar la configuración de OpenDMARC:

   • Puedes crear un archivo de configuración personalizado para OpenDMARC y montarlo en el contenedor de Docker Mailserver.
   • En el archivo de configuración de OpenDMARC (opendmarc.conf), puedes agregar o modificar las siguientes líneas para aumentar la verbosidad:

     LogLevel debug
     

   • Monta este archivo en el contenedor de Docker Mailserver. Por ejemplo, si tu archivo de configuración personalizado se llama opendmarc.conf y está en el directorio actual, puedes agregar lo siguiente a tu docker-compose.yml:

     services:
       mailserver:
         volumes:
           - ./opendmarc.conf:/etc/opendmarc.conf

2. Reiniciar el contenedor:

   • Después de modificar la configuración, reinicia el contenedor de Docker Mailserver para que los cambios surtan efecto:

     docker-compose restart mailserver

3. Verificar los logs:

   • Una vez que hayas aumentado la verbosidad, verifica los logs de OpenDMARC para obtener más detalles sobre por qué los mensajes están fallando:

     docker logs <CONTAINER_NAME>

Si necesitas más información sobre cómo configurar OpenDMARC, puedes consultar la documentación oficial de OpenDMARC.

This comment was generated by Glime.

[Kedarius]

Hey Glime, thank you for your perfect response in (probably) Spanish. I know how to disable opendmarc, and I think using ENABLE_OPENDMARC=0 is a better way than creating a config file with wrong option. And thanks pointing me to opendmarc github as their official documentation, while there is no mention of the option.

Just a side note: I do not want to be rude to generative AI, but it makes me kinda enraged, as I did such research before posting the question as I do not want to waste time of other people with something that I can google myself. I've found the official documentation ( http://www.trusteddomain.org/opendmarc/ ) and it does not mention LogLevel or any other log related option, that would increase the verbosity.

Also I think, that this way of adding config file is not the right one as it will not function with DMS default config....

[polarathene]

Just a side note: I do not want to be rude to generative AI, but it makes me kinda enraged

Adding Glime a few months back was an experiment to see if it could help with support as the present maintainers are rather short on time.

Previously Glime was doing quite well and sometimes even surprised me with the quality of it's responses. Lately it's been responding in Spanish for some reason rather frequently, and we've noticed it conjuring some poor answers that rehashed user content (even from the original message on the same thread) in a way that was invalid :\

So it's a bit hit or miss 🤷‍♂️

[Kedarius]

I understood that, and I did not want to sound rude and impolite, however it kinda triggers me to be honest. I did not only try to google the answer, look into the docs (here and opendmarc), but I also tried chatgpt and it gave me similarly wrong answer (it said to add LogLevel 20 and then re-queue the message with postsuper -r ).

[polarathene]

however it kinda triggers me to be honest

You can just ignore the AI. It only provides the single attempt to help once per issue/discussion.

Like I said it's hit or miss, but it's been helpful enough in the past for users that it remains enabled.

I appreciate the effort you've put in to troubleshooting, I'm just not sure if anyone will be able to assist.

---

If you're open to alternatives, I've heard stalwart is quite decent and easy. It might be a better choice for you?

[Kedarius]

I completely understand that, and I do have to say, that its answers can be sometimes very accurate. The only issue is, that I do not want to ignore it, as there is a chance it is right and I am not. So I still had to try, whether the LogLevel debug will not work. Because I really want to avoid wasting someone's time.....

EDIT: And thanks for the pointer to stalwart, but I really like postfix and dovecot, so I do not want to try something else....

[polarathene]

I'm not gong to be of much help here as this isn't an area I have expertise with.

I do know that our rspamd integration is meant to replace OpenDMARC, OpenDKIM, and some other features in DMS. It's presently not the default as we encourage users to try it and get feedback to address any integration issues, but the intention is to switch it over as the default in a future release.

Usually users find the quality of rspamd to be better, perhaps you're open to giving it a try? If you have any trouble or feedback regarding our docs on enabling rspamd, please let us know so we can improve those for everyone.

[Kedarius]

Thanks for your reply.
The issue with rspamd (for me) is that I am quite familiar with amavis, spamassasin, opendkim and almost all that rspamd is replacing. The only one thing I am not so familiar is opendmarc. So I may give rspamd a try, but it is way more learning for me - even though I want to use a "prepackaged" mail server in docker, I want to understand all system it uses.
And I am quite surprised that opendmarc does not have any option to debug its decisions - I mean blocking or rejecting the message is a decision that I need to be able to explain to my users.

[polarathene]

The issue with rspamd (for me) is that I am quite familiar with amavis, spamassasin, opendkim and almost all that rspamd is replacing

I understand. That's why we plan to still keep these options around after the switch to rspamd. Many of the popular mail projects like DMS have already switched to rspamd for some time now, so it might be that you'd need to get familiar with it anyway going forward 😅

I have no involvement with opendmarc, but we do the best that we can with what we have control over AFAIK. I especially try to ensure we provide good quality docs when I have the time to rewrite community contributed pages.

[Kedarius]

I will try rspamd and see how it behaves. After all, I am doing this to see, whether it is better to spin up a docker image of a mail server and not need to take care of it as much. I mean as much as if I would just install all by myself. So I can also learn something new on the way :-)