In article <59c8d406.7000...@openfortress.nl> you write: >I am looking forward to your responses. Please keep me in Cc: if possible?
I hate to be totally negative, but this draft revives a lot of things that we considered and rejected when we did DKIM. Marking content in an MUA is a WKBI*. There is no reason to believe that users would understand content marking or would make reasonable decisions based on it. As a general rule, anything that puts security policy in the hands of end users doesn't work. Think of all the browser bad SSL cert warnings you've clicked through. Also, there are more ways to change content that anyone can describe. Some of the harder to describe are recoding between 7 and 8 bit and base64, reducing the size and resolution of images (common on phones) and reordering MIME parts. Finally, it is pretty clear from the ARC work that big mail systems are more interested in telling recipient systems the identities of the parties that handled a message than how it changed or whether any of those parties thought the changes were a good idea. For another rejected approach see my DKIM conditional signatures, which let senders authorize intermediaries to modify and resign messages. https://datatracker.ietf.org/doc/draft-levine-dkim-conditional/ R's, John * - Well Known Bad Idea _______________________________________________ dmarc mailing list dmarc@ietf.org https://www.ietf.org/mailman/listinfo/dmarc
