Here's what it looks like with Topicbox's internal pair DKIM2-Signature: i=3; m=2; t=1792628404; d=topicbox.com; f=exploded; mf=PG0uczdjbWdlZ3plazR3eWtiN29tcGEuZHpzNWJ5YW5yeWk2cGtoenJidG5sc 2lhYXlAZmFzdG1haWwuYm91bmNlLnRvcGljYm94LmNvbT4=; rt=PGJyb25nQGZhc3RtYWlsdGVhbS5jb20+; s=sysmsg-1:rsa-sha256:cah0XlZW785NBUlJL9ffCrtgp4i95V/k+TIPi8uNsx HFIbAH3Qkf+9neeIarCCpFZKOl6ORCHOoPLq2UpRk9jsZOOfMLnqTaZB58VQd1zJ +1/DaV8reHFXvmACDSYWdrvJN3nI1iDv0GJgyv4Gu/txIHfh5jOJDnS/yubkLkq6 w=; DKIM2-Signature: i=2; m=2; t=1792628404; d=fastmail.topicbox.com; nd=topicbox.com; s=dkim-1:rsa-sha256:xeh/gg4v8rpdiu9aAxgnCuZMQ/3eytTtU6xH6WrvczEQ 91gvLgJ66r8sYFy3EGLkShZF0I5XeCQ188y36GtXfDNkHoAwDGzsoNsfQeCMfzhG d9Lc1fxYw9JpAT5c8hD+PT8ZI9PP150/5q30dYnlp5Xq+lAkbKNL5Cd7IyawmWA =;
Note that i=2 MUST be signed by a fastmail.topicbox.com domain key, and i=3 by a topicbox.com domain key, so neither can fake things by the other. Bron. On Wed, Oct 21, 2026, at 15:41, Richard Clayton wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > In message <[email protected]>, > [email protected] <[email protected]> writes > > >We are writing an independent DKIM2 verifier in Rust (OxiMail), against > >-06. Implementing the Chain of Custody checks, we found a gap around the > >nd= tag that lets anyone replay a signed message they merely received. > > please check the (tidied up and improved) spec-07 shipped a few days > back -- there are improvements here which I suspect fix your issue. Note > also that domain matching is also more carefully specified > > >Two smaller points, in case they are useful: > >- 8.1 and 11.2 disagree on whether gaps in the i= numbering are > > acceptable. > >- The error templates are written both as "PERMERROR " and as > > "PERMERROR:". > > I strongly expect you will find those fixed as well > > - -- > richard @ highwayman . com "Nothing seems the same > Still you never see the change from day to day > And no-one notices the customs slip away" > > -----BEGIN PGP SIGNATURE----- > Version: PGPsdk version 1.7.1 > > iQA/AwUBatlNuGHfC/FfW545EQK6KQCg/ctQundgD6fmMEUIFA+cceD1FHAAniCL > WYuQwCKiMghLZkkDiu8wNSJx > =CwIf > -----END PGP SIGNATURE----- > _______________________________________________ > Ietf-dkim mailing list -- [email protected] > To unsubscribe send an email to [email protected] > -- Bron Gondwana, CEO, Fastmail Pty Ltd / Fastmail US LLC [email protected]
_______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
