>>> +----------+--------------+ >>> | count(*) | mailing_list | >>> +----------+--------------+ >>> | 77246 | 0 | >>> | 78853 | 1 | >>> +----------+--------------+ >> >> That's just strange. Most of the l= signatures don't cover the whole >> body, and half of those didn't go through a mailing list?
> I suspect it's use of "l=" by a signer without regard to whether or not > the mail is heading to an MLM. For example, OpenDKIM's antecedent had > that as an option; only the evolution to OpenDKIM allowed you to be more > specific. Except that doesn't explain why l= doesn't cover the entire body. Signing or verifying bug? Clever spammer replaying signed mail and getting away with it? Forwarders of some sort that add a footer but otherwise don't look like mailing lists? Regards, John Levine, jo...@iecc.com, Primary Perpetrator of "The Internet for Dummies", Please consider the environment before reading this e-mail. http://jl.ly _______________________________________________ NOTE WELL: This list operates according to http://mipassoc.org/dkim/ietf-list-rules.html
