-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Several people have spoken up about the interaction between DMARC and
DKIM2 -- and the issues that arise when the RFC5322 From header field is
changed by an intermediary.
There is a straightforward way to address this -- which I would commend
to the working group.
We update the spec to say that when a From field is first placed into a
message (ie it sits alongside an i=1 DKIM2-Signature) or when it is
changed by an intermediary (there is a recipe that shows that it has
been changed at a particular hop) then DKIM2 will insist that there is
match between the d= domain being used to sign and the domain in the
RFC5322 From header field.
The appropriate match would seem to be the "relaxed" match described in
#9.4 .. viz if d= and the domain in the RFC5322 From header field are
not identical then remove labels until the values are identical or until
there are no labels remaining in which case there is no match.
Since in the real world no-one can sign for .com (or whatever your
publicly used TLD may be) this is just as safe as the MAIL FROM match
already required (and we don't need to wander into the world of tree-
walks or the PSL).
Since this fits with what a number of people have been asking for,
unless there is outrage (or an important use case where this would be
impossible) I will put appropriate text into spec-07 so that the detail
of the wording (rather than just the concept) can be considered by the
Working Group.
- --
richard @ highwayman . com "Nothing seems the same
Still you never see the change from day to day
And no-one notices the customs slip away"
-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1
iQA/AwUBapWQgmHfC/FfW545EQIf0wCgjNlZqZ19T/R52pHjBh5PXsXeBSQAn1ya
ypqXc1AYxPSFiM+YIThRE5Dq
=iOeT
-----END PGP SIGNATURE-----
_______________________________________________
Ietf-dkim mailing list -- [email protected]
To unsubscribe send an email to [email protected]
