I am checking an email for spam via isnotspam.com, in the results I'm receiving the following messages:

DomainKeys check details:

Result: neutral (message not signed)
ID(s) verified: header.From=production@studionec.com
DomainKeys DNS Record=

DKIM check details:

Result: pass
ID(s) verified: header.From=production@studionec.com
DomainKeys DNS Record=mandrill._domainkey.mail2.wdc04.mandrillapp.com

In the SpamAssassin results it shows the following:

* 3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100%
* [score: 1.0000]
* -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
* trust
* [ listed in list.dnswl.org]
* -0.0 SPF_HELO_PASS SPF: HELO matches SPF record
* -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
* domain
* -0.0 SPF_PASS SPF: sender matches SPF record
* 0.2 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
* [score: 1.0000]
* 0.1 HTML_MESSAGE BODY: HTML included in message
* 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
* valid
* -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
* 0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal
* information
X-Spam-Status: Yes, hits=4.8 required=-20.0 tests=BAYES_99,BAYES_999,
X-Spam-Score: 4.8

DK_SIGNED is presumably DomainKeys or DKIM, and it's giving a + 1.0 to the spam score, why is this happening and is there a way of stopping it?

I looked up DomainKeys and found the following listed in Wikipedia so is this a bug or poor configuration on my end?

Both DomainKeys and DKIM were published in May 2007. DomainKeys was issued as a "historical" protocol and DKIM was issued as its standards-track replacement.


The DK_SIGNED rule comes from the DomainKeys plugin. It should have a corresponding DK_VERIFIED rule to check that the DomainKeys signature is valid, which would negate the score (if DK_VERIFIED == true) for a neutral result. The absence of the verification check indicates a configuration issue in SpamAssassin.

Note that the DomainKeys plugin is deprecated; its author states:


Please move on to DKIM like a responsible Internet user. I have.

I will leave this module here on CPAN for a while, just in case someone has grown to depend on it. It is apparent that DK will not be the way of the future. Thus, it is time to put this module to ground before it causes any further harm.

The rules already include DKIM_SIGNED and DKIM_VALID, which are operating properly by adding to and then subtracting from the spam score, so it appears that the website's SA setup is incorrect.

| improve this answer | |
  • To clarify, the SA setup is isnotspam.com and not the emails origin website? Thanks! – Studio NEC Jun 23 '14 at 10:53
  • Yes, the evidence is the presence of DK_SIGNED. I checked the source of both modules, and only DomainKeys has a header with that name. – dartonw Jun 23 '14 at 12:43
  • Just realized what you were asking - by website's SA setup, I mean SpamAssassin on isnotspam.com. – dartonw Jun 23 '14 at 12:54
  • That's great, thanks for your help. I'll have to find another test website. – Studio NEC Jun 23 '14 at 15:43
  • You could try sending to check-auth@verifier.port25.com. This will reply with the details of basic SA processing. I tried it and they do use the DKIM module and not DomainKeys. See port25.com/support/authentication-center/email-verification for more details. – dartonw Jun 23 '14 at 16:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.