HotCRP.com's mail DKIM is invalid

[stummm]

hotcrp.com’s DKIM (domain keys identified mail) is invalid, which prevents me from receiving emails from HotCRP.com. It has a syntax error.

This can be verified here: https://mxtoolbox.com/dkim.aspx and entering "hotcrp.com" as domain and "email" for the selector.

Thanks very much, --michael

[kohler]

HotCRP uses this method:

https://mxtoolbox.com/SuperTool.aspx?action=dkim%3atestdkim._domainkey.hotcrp.com&run=toolpage

[kohler]

Is your email handled by Outlook? Unfortunately Outlook is blacklisting HotCRP.com.

[stummm]

Thanks kindly for the quick response, Eddie.

Yes, I'm afraid so. It's UofT's primary email server for the university (although some departments run their independent email servers). I'll see if our folks can un-blacklist HotCRP.com.

[kmccurley]

I remember that when I set up the IACR mail server (with postfix like mail.hotcrp.com) we had to first configure SPF, DKIM, and DMARC, but then we also had to apply manually for the Microsoft services of hotmail.com, live.com, msn.com, and outlook.com for them to stop blacklisting. I know this sounds ridiculous, but I think they had a default policy to reject an IP address or hostname they had not seen enough from in the past. They may also blacklist an IP address if they receive too many emails containing links because it triggers their crude trigger for detection of phishing. I haven't been impressed with their operation, and in fact when I signed up to have our domain whitelisted, the confirmation message from them had an invalid DKIM signature. 🤡 I think the process has changed now, but this looks relevant. There are a large number of universities who use the outlook hosting service so this is important (e.g., oregonstate.edu, utoronto.ca, kcl.ac.uk, fau.edu, gatech.edu, cornell.edu, kent.edu, purdue.edu, wpi.edu, ntu.edu.sg, uconn.edu, yale.edu, alum.mit.edu, etc.) They may apply different reputation scores for their hosted domains than they do for outlook.com.

It looks to me like your DKIM cert is OK (assuming that is what your server uses). Your DMARC policy is also OK and your IP address is not on any of the real-time blacklists I could find. There are just additional steps you might have to take for the Microsoft-based domains. It may depend on what code and message you see in the header with rejections.

It might be more complicated if you use subdomains on mail.hotcrp.com for the different conferences.