On Thu, Sep 17, 2026 at 3:34 AM Hanno Böck <[email protected]> wrote:
> "I've recently scanned DKIM keys for vulnerabilities, more extensively > than previous scans. DKIM keys with the Debian OpenSSL bug are still > very common. So are too-short RSA keys (quite a few 512 and even 384 > bit keys, and *many* 768 bit, which is still difficult to break, but > possible). > > Also, a notable number publish a private key in their DKIM record. > (This is only a problem if they actually use the same key elsewhere > correctly.) I tried disclosing things, but manual disclosure > impractical for thousands of affected hosts and automated disclosure is > difficult (plenty without security.txt, security@ often is rejected). > > Replies to disclosures also show a common misunderstanding: People > believe they are unaffected saying these keys are old and unused. This > shows a fundamental confusion about how digital signatures work. Or how email works. Or how the universe works. When I was identifying and facilitating the blocking of open relaying mail servers 25+ years ago, I had a similar problem. I tried to make notifications, but gave up. Many postmaster addresses didn't route, and any responses I got were somewhere between: (1) OMG, you're hacking me, stop it or I'm going to sue, or (2) I don't know what you mean or what this is, (3) I do this on purpose because I want to and you're mean. Or sometimes a combination of more than one of those! I don't really remember anybody being like wow, gee, thanks for the notification, I'll fix this ASAP. Incidentally, how did you find the keys? Searching for a public key record for a specific set of selectors for each domain? Or are you parsing existing messages to extract selector and domain? This is good stuff. Thanks for doing this, and sharing it. Cheers, Al Iverson -- Al Iverson | Industry Research and Community Engagement Lead Email: [email protected] Phone: (312) 725-0130 (Chicago) Calendar: https://xnnd.com/cal _______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
