Hello All
I have posted -07 of the DKIM2 deployment profile. This revision focuses
on three areas: formalizing per-hop verification reporting, completing
the enforcement model for partial-participation deployments and a
structural reorganization for readability.
Summary of the main changes:
- DKIM2-Authentication-Results formalized. The header is now fully
specified with ABNF, usage examples, and an IANA registration. It is
part of the signed header set at every hop, cumulative from i=1.
- Graduated enforcement model. Section 3.5.2 now gives a complete
decision procedure for what a verifier does with a failed chain:
structural failures (unresolvable key, malformed signature, unknown
algorithm) are rejected outright; failures where a participating node's
own declarations don't reconstruct the prior state constitute
cryptographic proof of dishonesty and are rejected; everything else - a
chain broken by a node that never participated in DKIM2 - is delivered
with the outcome recorded, not rejected. The rationale draws an explicit
comparison to DMARC's adoption burden: full-path DKIM2 participation is
a materially heavier requirement than a single DNS policy record, so
treating any non-participating hop as grounds for rejection would make
legitimate mail loss routine rather than exceptional.
- Structural reorganization. Chain of custody and the DKIM2-Signature
format are now presented together as a single section, in the order a
reader actually needs them (what the signature covers, then how it's
sequenced, before the signed-header-set details). The DSN and
enforcement section is retitled and reordered so the reporting and
enforcement mechanisms are introduced before the procedures that depend
on them, rather than being referenced forward.
Regards
Vittorio Moccia
_______________________________________________
Ietf-dkim mailing list -- [email protected]
To unsubscribe send an email to [email protected]
