Dňa 3. novembra 2023 16:18:05 UTC používateľ Chris Siebenmann via Exim-users <[email protected]> napísal:
>(In practice it's very rare and generally alarming to see multiple >instances of most headers.) AFAIK it was way to trick MUAs to show different value in eg. From: or Subject: fields. Without oversign, some MUAs will even show that message as with valid DKIM... Nowadays it is IMO considered as sender/signer configuration mistake (do not oversign crucial headers). >In Exim, the no-prefix case signs the header whether or not it's Yes, in enough recent version it is enough configurable, but requires to define own "rule" for headers selection to sign. >As you note, a sensible Exim default might be to use = a lot more than >the current settings. IMO select proper defaults is hard, as it depends. Old DKIM RFC defined exact headers, recent version step down from exact list and is vague in that. AFAIK there are two defaults defined as macros, and both are based on old RFC headers list, but IMO no one is really usable as is. If one select too few headers to sign, message can be resend modified, but DKIM still can be valid. If one signs/oversigns too many headers, legitimate flow can break DKIM, and message can have delivery problem. Especially in general purpose case, it can be hard to satisfy all flows... As it is hard to define universal headers list (that is as i understand that RFC's step down too), it can be worth to choose another approach for exim default: + make that headers list unset (empty) by default + force admins to define own list -- do not sign & log panic if unset, or even strong, consider it as config error and leave message in queue And leave current macros just as examples... >My impression is that Sender is relatively obscure now. It was It is not common, but it has reason/usage even nowadays -- at least to have track, who spoofed (possible legitime) From: header. In my setup, if Sender: appears in message, it is not considered suspicious (from outside) and i oversign it (from inside). >These days I believe most MTA setups either block unauthorized From: >alterations entirely or don't really care about it, so don't force the >addition of Sender:. IMO that is not MUA task, MUA has no way to know anything about which addresses i (user) can use. And, mail is not limited to be send from advanced MUA, i often compose and send emails from shell or Python/PHP (which technically is MUA too) without any limitations. Due that I force From:/Sender: checks at MSA, which has all needed knowledge for particular authenticated user. As result, no one can use spoofed nor duplicit From:, Sender: and some other headers (with some exceptions, but limited in rate). AFAIK exim adds Sender: header by default when From: differs from calling user (notSMTP) and it is configurable. It has some options for that for messages received over SMTP too, check docs for details. regards -- Slavko https://www.slavino.sk/ -- ## subscription configuration (requires account): ## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/ ## unsubscribe (doesn't require an account): ## [email protected] ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://wiki.exim.org/
