-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
In message <[email protected]>, Pete
Resnick <[email protected]> writes
>[Without my chair hat on. This is basically a technical comment, but I
>do think this framing will get it through the process a bit easier.]
>
>On 31 Aug 2026, at 9:32, Richard Clayton wrote:
>
>> We update the spec to say that when a From field is first placed into
>> a
>> message (ie it sits alongside an i=1 DKIM2-Signature) or when it is
>> changed by an intermediary (there is a recipe that shows that it has
>> been changed at a particular hop) then DKIM2 will insist that there is
>> match between the d= domain being used to sign and the domain in the
>> RFC5322 From header field.
>
>If the group wants to go down this path (and it's sounding like it
>does), I would very much suggest that the requirement gets put on the
>generator and not on the interpreter:
by which I assume you mean "Verifier"
>Make the requirement that the
>domain in the From: header field MUST sign the message. Then we don't
>get into the business of telling receivers what they need to do with the
>message.
we could do this by making the requirement on a Verifier that they MAY
reject the message and MUST NOT forward it outside their org. That way
we have a place to specify a canonical rejection message (which assists
with interworking / debugging etc)
>Note that this is an explicit change from DKIM1: In DKIM1,
but not from DMARC ...
> the semantic
>content of the message was explicitly ignored; the only thing it told
>you is that some domain signed the message, and it acted strictly at the
>SMTP layer. If we go down this path, in DKIM2 we would be saying that
>the signature (or at least one signature) depends on the x22 content of
>the message. I'm not saying that's wrong; I'm simply saying that we
>should be explicit about that in the document if this is the path we
>choose.
... and it is not a change from what pretty much all email with DKIM1
signatures does today; viz: this is going to actually affect almost no-
one apart perhaps from really old systems which are not DKIM1 signing
today -- if they are authenticating at all it is by using SPF
- --
richard @ highwayman . com "Nothing seems the same
Still you never see the change from day to day
And no-one notices the customs slip away"
-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1
iQA/AwUBaq/3bWHfC/FfW545EQLExgCguJLQH30VBzlicofZpSy3WgPJ+kEAoNHl
9IirxRg1Wvulr629RllIdasl
=3kgV
-----END PGP SIGNATURE-----
_______________________________________________
Ietf-dkim mailing list -- [email protected]
To unsubscribe send an email to [email protected]
