DKIM failures for gitlab mail

[Joachim Breitner]

Hi Bryan (I assume),

I noticed that a small number of Gitlab notification emails end up in
my spamfilter. While there is not much you can do about triggering some
bayesian style spam filter at my email provider (mailbox.org), I did
notice this in the headers:

X-Spam-Status: No, score=2.704 tagged_above=2 required=6
        tests=[DKIM_INVALID=0.1, DKIM_SIGNED=0.1, HS_RSPAMD_10_11=2.5,
        HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001,
        URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Authentication-Results: spamfilter01.heinlein-hosting.de (amavisd-new);
        dkim=fail (1024-bit key) reason="fail (bad RSA signature)"
        header.d=gitlab.haskell.org
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;
d=gitlab.haskell.org;
        s=mail; t=1669733134;
        bh=D0NUcHiskEnwSP99umP3zo8Fz8fl74OgAJ8NRDKCsp4=;
        h=Date:From:Reply-To:To:In-Reply-To:References:Subject:List-Id:
         List-Unsubscribe;
        b=R+WMLfhRZZdYxMd6K6w+iodDe8EHzwONNArNyboqsU5NnafPRhKZ1UeGxO/BCMvEK
         M7XHRRrBsPfRYpTph7xSGY427KGXieASVg1GDhAiwKSLBCiqDdkBaoJLLUIfUD02NS
         ouI3tvQ9mddNdaEK7retq8N+29hzs/ezf9cpgy+Q=


It seems the DKIM configuration is broken? There is a DKIM record for
the domain that’s valid acccording to 
https://www.dmarcanalyzer.com/de/dkim-de/dkim-record-check/?dmarcdns%5Btype%5D=dkim&dmarcdns%5Bselector%5D=mail&dmarcdns%5Bdomain%5D=gitlab.haskell.org&g-recaptcha-response=03AEkXODBDl43rk3Ww0q4J1LNooZNlqBYhWGd3spu68KM7nc3js92zXASAuHqVAek5IJj2iV26sx7LzrDQYX08fq2lnL5CvX4P4x7GOekNSV9yG9J48z0I3SxPzy5tQomgP4u9YR8yQqsmZwezj8coIagpBTce9Ubytv_nRg3oKmJjSYsJP5Pwc4Jmgn___e1nbsHUEqNWabdCJHX0Q02oZ3n3sRS5K8LpYOAFhYhOhMQF9QPQ74Uy8fc38lcuK3LJP6Dk5Z2xmgLJypXJiW4svbNTqnndkSehXM-Y5HJ7xdFZ3aMA4yiOwOOYjZwKc2reQDQ6v6TLrYnigFYgA6D4MM2PBRoc6-D5Zr3xbkjPMOlFVXNMGHpu_w4_nTIaTyRhYaBb1ilz7lYa15f8si5-vVuqT-XFe0U1nVsYHWBj-ejC3Ih7QQzaXdlegM3VMLZ94qBeK5b6uA7fbJv_EpMx3K6EbwVyfmsElNx9KnHOciAcQguIXUxU-EOTN900w-lAoqhxVG-VyqIQe8L99_eW6Ns5IV2tLp4qSg
but maybe Postfix  is not using the right key?

Cheers,
Joachim


-- 
Joachim Breitner
  mail at joachim-breitner.de
  http://www.joachim-breitner.de/