Logging: disable the verbose DKIM verification line by default; add a tag to <= lines.

New log_selector controls "dkim" and "dkim_verbose".

2 files changed, 25 insertions, 0 deletions

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 844178fca..aa6da73d3 100644
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -36058,6 +36058,7 @@ the following table:
 &`    `&        command list for &"no mail in SMTP session"&
 &`CV  `&        certificate verification status
 &`D   `&        duration of &"no mail in SMTP session"&
+&`DKIM`&        domain verified in incoming message
 &`DN  `&        distinguished name from peer certificate
 &`DS  `&        DNSSEC secured lookups
 &`DT  `&        on &`=>`& lines: time taken for a delivery
@@ -36127,6 +36128,12 @@ A delivery set up by a router configured with
 .endd
 failed. The delivery was discarded.
 .endlist olist
+.next
+.new
+.cindex DKIM "log line"
+&'DKIM: d='&&~&~Verbose results of a DKIM verification attempt, if enabled for
+logging and the message has a DKIM signature header.
+.wen
 .endlist ilist
 
 
@@ -36154,6 +36161,8 @@ selection marked by asterisks:
 &`*delay_delivery             `&  immediate delivery delayed
 &` deliver_time               `&  time taken to perform delivery
 &` delivery_size              `&  add &`S=`&&'nnn'& to => lines
+&`*dkim                       `&  DKIM verified domain on <= lines
+&` dkim_verbose               `&  separate full DKIM verification result line, per signature
 &`*dnslist_defer              `&  defers of DNS list (aka RBL) lookups
 &` dnssec                     `&  DNSSEC secured lookups
 &`*etrn                       `&  ETRN commands
@@ -36260,6 +36269,17 @@ precision, eg. &`DT=0.304`&.
 &%delivery_size%&: For each delivery, the size of message delivered is added to
 the &"=>"& line, tagged with S=.
 .next
+.new
+.cindex log "DKIM verification"
+.cindex DKIM "verification logging"
+&%dkim%&: For message acceptance log lines, when an DKIM signture in the header
+verifies successfully a tag of DKIM is added, with one of the verified domains.
+.next
+.cindex log "DKIM verification"
+.cindex DKIM "verification logging"
+&%dkim_verbose%&: A log entry is written for each attempted DKIM verification.
+.wen
+.next
 .cindex "log" "dnslist defer"
 .cindex "DNS list" "logging defer"
 .cindex "black list (DNS)"
diff --git a/doc/doc-txt/NewStuff b/doc/doc-txt/NewStuff
index cfa44b713..15722e114 100644
--- a/doc/doc-txt/NewStuff
+++ b/doc/doc-txt/NewStuff
@@ -20,6 +20,11 @@ Version 4.91
  4. SPF support is promoted from Experimental to mainline status.  The template
     src/EDITME makefile does not enable its inclusion.
 
+ 5  Logging control for DKIM verification.  The existing DKIM log line is
+    controlled by a "dkim_verbose" selector which is _not_ enabled by default.
+    A new tag "DKIM=<domain>" is added to <= lines by default, controlled by
+    a "dkim" log_selector.
+
 
 Version 4.90
 ------------