I’ve seen mention of this in passing in the middle of long threads about other things, but I’d like to get clarification.
The public key size of mldsa44 is 1312 bytes, base64 encoded about 1750 bytes. Maximum UDP size for DNS is usually configured to be 1220 bytes. Validating mldsa44 signed mail will not work via DNS over UDP, and in the common case the recursive resolver will get a truncated response and fall back to querying over TCP. So delivering mail signed with mldsa44 requires working DNS over TCP, at recursive resolvers and authoritative servers “everywhere”, or at least every recursive resolver used by a mailserver. And their associated packet filters and firewalls. Am I missing something? If not, do we mention this explicitly anywhere? Cheers, Steve _______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
