Re: [mailop] Dealing with a DKIM replay attack

2016-08-14 Thread Eliot Lear
On 8/14/16 6:46 AM, Steve Atkins wrote: > If there were a protocol that said "if you receive mail signed by this > domain / this key and the recipient isn't in the To: or Cc: field, > block it", or some similar protocol that signed the envelope > recipient, that would pretty much eliminate DKIM

Re: [mailop] Dealing with a DKIM replay attack

2016-08-14 Thread John Levine
>If there were a protocol that said "if you receive mail signed by this domain >/ this key and the recipient isn't in >the To: or Cc: field, block it", or some similar protocol that signed the >envelope recipient, that would pretty much >eliminate DKIM replay as a threat in some cases. It

Re: [mailop] Dealing with a DKIM replay attack and yahoo's use of DKIM domains for FBL reports

2016-08-14 Thread Vick Khera
On Fri, Aug 12, 2016 at 7:12 PM, Tim Starr wrote: > The only benefit I can see from sending the exact same message from > somewhere else would be to drive recipients to the same payload link, which > suggests another possible way to stop this from paying off after detection: