REMOVE_DKIM_HEADERS = 3 renames headers X-Mailman-Original...

2 files changed, 10 insertions, 1 deletions

diff --git a/Mailman/Defaults.py.in b/Mailman/Defaults.py.in
index 3569cc07..4ae5633f 100755
--- a/Mailman/Defaults.py.in
+++ b/Mailman/Defaults.py.in
@@ -616,8 +616,10 @@ NNTP_REWRITE_DUPLICATE_HEADERS = [
 # broken and even if the outgoing message is resigned.  However, some sites
 # may wish to remove these headers.  Possible values and meanings are:
 # No, 0, False -> do not remove headers.
-# Yes, 1, True -> remove headers only if the list's from_is_list setting is 1.
+# Yes, 1, True -> remove headers only if we are munging the from header due
+#                 to from_is_list or dmarc_moderation_action.
 # 2 -> always remove headers.
+# 3 -> always remove, rename and preserve original DKIM headers.
 REMOVE_DKIM_HEADERS = No
 
 # All `normal' messages which are delivered to the entire list membership go
diff --git a/Mailman/Handlers/CleanseDKIM.py b/Mailman/Handlers/CleanseDKIM.py
index 2cfb07af..d74db7fe 100644
--- a/Mailman/Handlers/CleanseDKIM.py
+++ b/Mailman/Handlers/CleanseDKIM.py
@@ -43,6 +43,13 @@ def process(mlist, msg, msgdata):
            )
        ):
         return
+    if (mm_cfg.REMOVE_DKIM_HEADERS == 3):
+        for value in msg.get_all('domainkey-signature', []):
+            msg['X-Mailman-Original-DomainKey-Signature'] = value
+        for value in msg.get_all('dkim-signature', []):
+            msg['X-Mailman-Original-DKIM-Signature'] = value
+        for value in msg.get_all('authentication-results', []):
+            msg['X-Mailman-Original-Authentication-Results'] = value
     del msg['domainkey-signature']
     del msg['dkim-signature']
     del msg['authentication-results']