[Without my chair hat on. This is basically a technical comment, but I
do think this framing will get it through the process a bit easier.]
On 31 Aug 2026, at 9:32, Richard Clayton wrote:
We update the spec to say that when a From field is first placed into
a
message (ie it sits alongside an i=1 DKIM2-Signature) or when it is
changed by an intermediary (there is a recipe that shows that it has
been changed at a particular hop) then DKIM2 will insist that there is
match between the d= domain being used to sign and the domain in the
RFC5322 From header field.
If the group wants to go down this path (and it's sounding like it
does), I would very much suggest that the requirement gets put on the
generator and not on the interpreter: Make the requirement that the
domain in the From: header field MUST sign the message. Then we don't
get into the business of telling receivers what they need to do with the
message.
Note that this is an explicit change from DKIM1: In DKIM1, the semantic
content of the message was explicitly ignored; the only thing it told
you is that some domain signed the message, and it acted strictly at the
SMTP layer. If we go down this path, in DKIM2 we would be saying that
the signature (or at least one signature) depends on the x22 content of
the message. I'm not saying that's wrong; I'm simply saying that we
should be explicit about that in the document if this is the path we
choose.
pr
--
Pete Resnick https://www.episteme.net/
All connections to the world are tenuous at best
_______________________________________________
Ietf-dkim mailing list -- [email protected]
To unsubscribe send an email to [email protected]
