On Mon, Oct 19, 2026 at 7:54 AM Richard Clayton <[email protected]> wrote:
> -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > In message <[email protected] > il.com>, Wei Chuang <[email protected]> writes > > >I've written up this idea in a -04. Please take a look in > >https://datatracker.ietf.org/doc/html/draft-chuang-dkim2-sender-policy-04 > . > >I've also removed the "unaligned" flag proposal. Comments are very much > >welcome. > > assuming no huge outcry about changes in -07 ... > > You should leverage the concept of "Validly Signed DKIM2 Message" from > spec-07 in #2.2.2 and you should carefully review your analysis because > I think get you the wrong result when the i=1 DKIM2-SIgnature header has > an nd= tag present. > > I don't think #3.1 contains anything except details of flags that don't > exist any more, and a superficial explanation of what exploded means > (which adds nothing to the material in #15 of spec-07) > > #3.2 is not a "modification to DKIM2" it is a proposal for material to > add to the BCP. > > I am also entirely unconvinced of the value of auth=spf at all... does > this mean that a Validly Signed DKIM2 Message should be rejected when it > has been forwarded ? and do you expect later recipients of a message to > re-assess the auth= flags ?? > No, it signals that a forwarding relay does not support DKIM2, and for that matter DKIM, or SPF. If a message originates at DKIM2 sender, that then goes through such a forwarder, a DKIM2 receiver will see the message has a broken chain of custody. It can look up the DMARC policy of the forwarder to determine if it supports DKIM2 or in this case just SPF. The receiver can then choose to accept or reject these messages as accepting them carries some risk of replay. I agree there isn't much utility in publishing auth=spf, but publishing auth=dkim has more value as that indicates a signature should be expected much like DKIM2. It also helps signal a lack of support for legacy algorithms SPF and DKIM, serving as a signaling mechanism to senders and for ecosystem surveys. -Wei In my view, you should ONLY define auth=dkim2 and you should make clear > that this is ONLY intended to be used by DMARC evaluators who have a > message in their hands which is not a "Validly Signed DKIM2 Message" (or > if they don't understand how to determine that, "a message") and if so > then they should determine that the message has failed to authenticate. > > I don't see any other scenarios where any other flag value could > usefully influence a decision. > > - -- > richard @ highwayman . com "Nothing seems the same > Still you never see the change from day to day > And no-one notices the customs slip away" > > -----BEGIN PGP SIGNATURE----- > Version: PGPsdk version 1.7.1 > > iQA/AwUBatYu52HfC/FfW545EQIJZACg6t7JHPW8wlAwqLWjLF4KQdGV8TYAnjMn > rpmiMTAF97H1S1edJeZTsIGs > =XMyO > -----END PGP SIGNATURE----- > _______________________________________________ > Ietf-dkim mailing list -- [email protected] > To unsubscribe send an email to [email protected] >
_______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
