chaas/ispmail-workaround-org
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

add allow_username_mismatch and explanation
All checks were successful
/ build (push) Successful in 51s
Details

Browse source
This commit is contained in:
Christoph Haas 2026-08-02 01:42:28 +02:00
parent 0f5f192e94
commit dd6f008721
1 changed files with 11 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

11
src/content/docs/ispmail-trixie/310-prevent-spoofing-dkim.mdx
View file

@ -288,6 +288,7 @@ configuration file:
cat > /etc/rspamd/local.d/dkim_signing.conf << 'EOF' cat > /etc/rspamd/local.d/dkim_signing.conf << 'EOF'
path = "/var/lib/rspamd/dkim/$domain.$selector.key"; path = "/var/lib/rspamd/dkim/$domain.$selector.key";
selector_map = "/etc/rspamd/dkim_selectors.map"; selector_map = "/etc/rspamd/dkim_selectors.map";
allow_username_mismatch = true;
EOF EOF
# Restart rspamd # Restart rspamd
@ -305,6 +306,16 @@ echo example.org 2025100901 > /etc/rspamd/dkim_selectors.map
That’s all. rspamd now knows that whenever it sees an outgoing email from `anyone@example.org` it will get the DKIM That’s all. rspamd now knows that whenever it sees an outgoing email from `anyone@example.org` it will get the DKIM
private key from /var/lib/rspamd/dkim/**example.org**.**2025100901**.key and use it to sign the email. private key from /var/lib/rspamd/dkim/**example.org**.**2025100901**.key and use it to sign the email.
The `allow_username_mismatch` setting makes rspamd sign an email even if the
authenticated user (during relaying) does not match the actual sender address.
Sounds complicated? Well, the use case is _aliases_. Imagine that
`john@example.com` has an alias address of `pizza@example.org`. If John logs in
as `john@example.org` but chooses to set his sender address to
`pizza@example.org` then rspamd will (by default) not add a DKIM signature due
to a mismatch. Setting `allow_username_mismatch` overrides this behavior and
John's email will be signed even if he sends on behalf of `pizza@example.org`.
(Thanks, DBL, for the hint.)
### Send a test email ### Send a test email
You could either just send an email from your mail client (or Roundcube) through your mail server to another email You could either just send an email from your mail client (or Roundcube) through your mail server to another email