# Config file for zdkimfilter
# Syntax of each line: [ "#" comment ] | name [ "=" ] [ value ]
# Backslashes ("\") can be used to wrap multiple physical lines into a single
# logical one, also comments.
# Valid names are shown below.
# Value types can be strings, array of strings, integers, or boolean,
# according to the name. Types and default values are shown commented; all
# boolean values default to "N", and "Y" is assumed if the value is omitted.

# all_mode
# Courier runs all-mode filters after non-all-mode ones, in alphabetical order.
# Non-all-mode filters can be whitelisted by local filters. In addition, any
# global filter can whitelist the filters running after it.
all_mode = @zdkimfilter_mode@

# verbose
# Loosely control the amount of output.
# The filter prints to stderr, assuming that courier's logger will capture it
# and send to syslog. Hence log entries can also be filtered by severity.
# Verbosity and severity are not strictly related. Verbosity is tentatively
# being used as follows (each level includes the preceding ones):
# 0: startup issues or totally unexpected errors
# 1: failures or unexpected events
# 2: removal of A-R on verify; missing domain on sign
# 3: start/stop info, relevant verify results, sign errors, response except 250
# 4: response returned to courier for each message
# 5: verify errors except no signature
# 6: domain/selector used on signing, any A-R field found
# 7: no key on signing; no signature and count of A-R written on verify
# 8: more debugging
# default:
# verbose = 3

# directory for domain private keys
# File names should be identical to the domain name:
# If user@example.com sends via authenticated smtp, then zdkimfilter looks
# for a file named example.com in this directory.
# domain_keys = @COURIER_SYSCONF_INSTALL@/filters/keys

# canonicalization for header/body. can be simple or relaxed
# header_canon_relaxed = N
# body_canon_relaxed = N

# sign_algo can be rsa-sha1 or rsa-sha256
# sign_rsa_sha1 = N

# key_choice_header
# Header fields from where to determine the signing domain.  This is an array
# of strings, empty by default.  The elements of this array can be header
# fields names or one the special symbols dash ("-") and star ("*"), in order
# of decreasing preference.
# Field names are searched in the message's header, and the domain name is
# derived from any mailbox specification in their value.  For star ("*"), the
# domain name is derived from the authenticated user id, if it contains a "@",
# otherwise the default_domain is used.  For dash ("-"), the default_domain is
# used.  A list of domain names and corresponding keys is obtained that way,
# the first key, if any, is used for signing.  For example, with
#
# key_choice_header = from -
#
# then if a key and possibly a selector are defined for the domain in the From
# header field, then they are used for signing, otherwise the default domain
# (defined below) is used, irrespectively of the authenticated user id.
#
# The default value of this parameter is
#
# key_choice_header *

# default_domain
# used if no domain can be derived from authenticated user id or dash ("-").
# String.  Empty by default.

# selector
# Each key should be a softlink; the basename of the linked to file
# contains the selector. If the basename starts with the same string as the
# link, i.e. the domain name, then that initial part and an optional dot
# are skipped. In addition, an extension of ".private" or ".pem" is discarded.
# E.g., the following will all result in assigning selector "s" to the key for
# "example.com":
#
#    example.com -> ../anywhere/example.com.s
#    example.com -> ../anywhere/example.coms
#    example.com -> ../anywhere/s
#    example.com -> ../anywhere/example.com.s.private
#    example.com -> ../anywhere/example.coms.private
#    example.com -> ../anywhere/s.private
#    example.com -> ../anywhere/example.com.s.pem
#    example.com -> ../anywhere/example.coms.pem
#    example.com -> ../anywhere/s.pem
#
# If a selector name cannot be determined that way, then the selector specified
# here, if any, or the constant "s" will be used.
#
# selector = s

# sign_hfields
# header fields to be signed.
# This is a space-separated list of header field names.
# The default value is implemented in OpenDKIM according to RFC 4871 Sect. 5.5
# sign_hfields = From Sender Reply-To Subject Date Message-ID To Cc    \
# MIME-Version Content-Type Content-Transfer-Encoding Content-ID       \
# Content-Description Resent-Date Resent-From Resent-Sender Resent-To  \
# Resent-Cc Resent-Message-ID In-Reply-To References List-Id List-Help \
# List-Unsubscribe List-Subscribe List-Post List-Owner List-Archive

# skip_hfields
# header fields not to be signed; they are discarded at an earlier stage.
# This is a space-separated list of header field names.
# The default value is implemented in OpenDKIM according to RFC 4871 Sect. 5.5
# skip_hfields = Return-Path Received Comments Keywords


# no_signlen
# set this to avoid specifying the l= parameter of the body length
# no_signlen

# temporary directory. libopendkim uses /var/tmp by default.
# if you specify a value of /tmp/xyz, zdkimfilter attempts mkdir of it
# on loading, if it cannot stat it
# tmp = /var/tmp

# on some errors, return 432; otherwise, just let the msg through
# tempfail_on_error

# no_spf
# if Courier set Received-SPF: pass for sender or helo, report that in A-R
# unless no_spf is set
# no_spf

# add_a_r_anyway
# Add an A-R field also if no signature or other A-R had been found

# no_author_domain
# The filter may reject or drop messages according to ADSP.  The three
# conditions that cause this behavior are as follows:
#
#   Nxdomain:    the author's address, as given in the "From:" header, contains
#                a non-existing domain name.
#   All:         the author domain specifies a policy whereby all messages must
#                have an author domain signature, but this messages has none.
#   Discardable: as case All, but the author domain further asks that non-
#                compliant messages be just discarded, in order to avoid
#                useless backscatter.
#
# When ADSP is enabled, the filter rejects messages in cases N and A, and drops
# messages in case D.  This behavior can be mitigated by whitelisting specific
# cases by domain name, if such name can be authenticated by SPF or DKIM (see
# the next two parameters.)
#
# When ADSP is disabled, the filter never rejects nor drops messages.  If one
# of the cases above is detected, the A-R field will have a line specifying
# the result as dkim-adsp=nxdomain (for Nxdomain), dkim-adsp=fail (for All), or
# dkim-adsp=discard (for Discardable).
#
# If any user may subscribe to a mailing list, enabling ADSP will result in
# malfunctions when someone publishes a non-default ADSP policy.  Conversely,
# unless you can prevent your users from subscribing to mailing lists, don't
# publish an ADSP policy different from "unknown".  (Publishing "unknown"
# results in better caching, though.)
#
# In order to enable ADSP, comment out the following line
no_author_domain

# spf_whitelist
# Exceptions for ADSP behavior, if enabled. If there is a whitelisted spf-
# authenticated sender, an invalid <john.doe@NOSPAM.example.com> passes even if
# no_author_domain is false and ADSP behavior requires otherwise (see previous
# option).
#
# This is a space-separated list of domain names. By default it's empty.

# dkim_whitelist
# Exceptions for ADSP behavior, if enabled. An invalid or discardable author
# domain passes if there is a good DKIM signature from a whitelisted domain.
# NOTE: no attempt is done to check that the whitelisted domain had validated
# the author signature before possibly breaking it.
#
# This is a space-separated list of domain names. By default it's empty.

# no_reputation
# skip a query to dkim-reputation.org for the signer. The result is reported in
# A-R for method "x-dkim-rep" according to the two values specified next
# no_reputation = N

# reputation_fail
# any values greater or equal than this are reported as "fail"
# reputation_fail = 32767

# reputation_pass
# any values less or equal to this are reported as "pass"
# values V in between, reputation_pass < V < reputation_fail, are reported
# as "neutral". According to dkim-reputation.org, 0 is neutral and positive
# values give an estimate of the spamminess of a given user. They reserve
# negative values for whitelisting. Their range is thus -1000 <= rep <= 1000.
# reputation_pass = -32768

# no_dwl
# skip a query to dwl.spamhaus.org for the signer. The result is reported in
# A-R for method "x-dwl" in case of positive results.
# no_dwl = N

# stats_file
# full path for a stats file about signatures verifications, including a line
# for each non-signed message. Setting this parameter enables writing stats.
# The default is an empty string, which disables writing stats.

# stats_wait
# max number of seconds to wait before obtaining a lock on the stats file, in
# order to write one or more line for the verified message. Waiting is done
# after the response has been given, so as not to block the server. The default
# is 20 minutes
# stats_wait = 1200