On Thu, Sep 10, 2026 at 2:57 PM Wei Chuang <weihaw= [email protected]> wrote:
> Hi all, > I've created an Internet-Draft form of this proposal: > > DKIM2 Sender Policy > draft-chuang-dkim2-sender-policy-00 > > Abstract > This document updates DMARC RFC9989 for DKIM2. In particular DKIM2 > verification supports MTA relay forwarding with message modifications > through multiple MTAs, so this updates DMARC to support those scenarios as > well. While DMARC defines a RFC5322 From alignment constraint with an > enforcement policy if validation fails, this generalizes and separates > enforcement policy from constraint validation policies. This provides a > mechanism for MTAs to declare support for DKIM2 through the DMARC DNS > policy record that helps secure DKIM2 from downgrade attacks. > > https://datatracker.ietf.org/doc/draft-chuang-dkim2-sender-policy/ > > It seems like there's something missing in your document, namely an explicit mention that RFC 9989 is being updated to include DKIM2 as an Authentication Mechanism, as described in RFC 9989, Section 4.3 - https://www.rfc-editor.org/info/rfc9989/#authentication-mechanisms I believe that Section 1.2.2 in your document, DMARC Authentication with DKIM2, should explicitly state (all caps for emphasis): This modifies DMARC to ADD DKIM2 AS AN AUTHENTICATION MECHANISM FOR DETERMINING AUTHENTICATED IDENTIFIERS IN DMARC (RFC9989 SECTION 4.3) AND TO allow SMTP MTA to declare which authentication method it supports to prevent authentication downgrade or spoofing attacks. Otherwise, this sentence in the last paragraph of that section makes no sense: Mail Receivers checks the Identifier Alignment as described in [RFC9989 <https://www.ietf.org/archive/id/draft-chuang-dkim2-sender-policy-00.html#RFC9989>] Section 3.2.10 between the RFC5322 From header field Author domain and the DKIM2 signature d= domain. because Section 3.2.10 in RFC 9989 reads: DMARC describes the concept of alignment between the Author Domain <https://www.rfc-editor.org/info/rfc9989/#author-domain> (Section 3.2.2 <https://www.rfc-editor.org/info/rfc9989/#author-domain>) and an Authenticated Identifier <https://www.rfc-editor.org/info/rfc9989/#authenticated-identifiers> (Section 3.2.1 <https://www.rfc-editor.org/info/rfc9989/#authenticated-identifiers>) and Section 3.2.1 in RFC 9989 reads: Authenticated Identifiers are those domain-level identifiers for which authorized use is validated using a supported authentication mechanism <https://www.rfc-editor.org/info/rfc9989/#authentication-mechanisms> (Section 4.3 <https://www.rfc-editor.org/info/rfc9989/#authentication-mechanisms>) So unless section 4.3 in RFC 9989 is updated, I don't see how DMARC alignment can be checked with DKIM2. -- Todd
_______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
