Subject: [ietf-dkim] 2 Day Collection Stats

From: Hector Santos <[email-masked]>
Date: Thu, 14 Oct 2010 20:42:04 -0400

This is a small 2 days collection break down of the signed mail coming in:

- total msgs  :    67028
- dkim_sign   :     1779  (2.7% signed)

- dkim_pass   :     89.9%
- dkim_fail   :     10.1%
   --    25.9% : dkim_body_hash_mismatch
   --    14.0% : dkim_signature_bad
   --    37.6% : dkim_signature_bad_but_testing
   --    15.2% : dkim_selector_dns_perm_failure
   --     2.8% : dkim_selector_invalid
   --     4.5% : dkim_selector_granularity_mismatch

- ADSP domains:     10.7% (of the signed messages)

   --    38.5% : unknown  (78.2% Third Party)
   --    61.5% : all      (13.3% Third Party)
   --     0.0% : discardable

I should probably add a recording which of these has List-IDs, but I 
think the high body hash failures are most list systems.  Its 
interesting to see such a high selector failure. I think the 2.8% 
invalid selector has to do with mix ups with SPF records.

-- 
Hector Santos, CTO
http://www.santronics.com
http://santronics.blogspot.com

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Barry Leiba <[email-masked]>
Date: Fri, 15 Oct 2010 13:47:31 -0400

> This is a small 2 days collection break down of the signed mail coming in:

Thanks.

>   --    25.9% : dkim_body_hash_mismatch

I was going to ask...

> think the high body hash failures are most list systems.

...but you answered.

> invalid selector has to do with mix ups with SPF records.

Yes, interesting, indeed.

Related to one of the current discussions, can you check the presence
of "g=x" in the key records, where x is neither empty nor "*" ?

Barry, as participant

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 15 Oct 2010 11:03:13 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Barry Leiba
> Sent: Friday, October 15, 2010 10:48 AM
> To: Hector Santos
> Cc: [email-masked]
> Subject: Re: [ietf-dkim] 2 Day Collection Stats
> 

We do have that recorded.  Of 10,561 signatures for which the body hash failed, 8,219 (77.8%) appeared to be list traffic (i.e. had a "List-*" header field or a "Precedence: list" field).

Breaking that down further:  Of the 8,219, 6,614 (80.4%) were author domain signatures, so the rest were presumably list signatures (or something else).

57 of them failed even in the presence of an "l=" tag.

---

From: "Mark Delany" <[email-masked]>
Date: 15 Oct 2010 11:15:17 -0700

> 57 of them failed even in the presence of an "l=" tag.

More work for Murray. Distribution of the l= values? Particularly l=0

Mark.

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 15 Oct 2010 11:40:43 -0700

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Mark Delany
> Sent: Friday, October 15, 2010 11:15 AM
> To: [email-masked]

Total signatures to date: 333764
Signatures with no "l=": 319774 (95.8%)
Signatures with "l=0": 1120 (0.3%)
Signatures with other "l=" values: 12870 (3.9%)

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 15 Oct 2010 11:50:31 -0700

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Murray S. Kucherawy
> Sent: Friday, October 15, 2010 11:41 AM

And, anticipating the next question(s):

Signatures with other "l=" values that were in turn larger than the message received: 10389
Subset of those that still passed: 9870 (95%)
Subset of those that still passed and looked like list traffic: 5504 (53%)

Based on that it looks like "l=" is pretty effective, but not very widely used.

---

From: Hector Santos <[email-masked]>
Date: Fri, 15 Oct 2010 15:21:13 -0400

> Based on that it looks like "l=" is pretty effective, but not 

I did a short testing on this (but turned if off for now) where for 
one domain, I prepared the signing to:

     - use l=
     - excluded Subject in h=

and the list mail survived with the original signature and the new 
resign signature.

What it basically told me that we (my implementation) might have to 
add feature for a "Target" signing rule:

    if target is for a list then use
       - use l=
       - excluded Subject in h=
    otherwise
       - don't use l=
       - subject is in the h=

But right now, list mail resigning strips the original.