-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In message <178232634716.1360785.12363329888242618970@dt-datatracker- f9b87776f-xzl65>, [email protected] writes
>Internet-Draft draft-ietf-dkim-dkim2-spec-03.txt is now available. It is a >work item of the Domain Keys Identified Mail (DKIM) WG of the IETF. > > Title: DomainKeys Identified Mail Signatures v2 (DKIM2) > Authors: Richard Clayton > Wei Chuang > Bron Gondwana > Name: draft-ietf-dkim-dkim2-spec-03.txt > Pages: 42 > Dates: 2026-06-24 the changes are (and these affect implementors, so if you own code you will need to look at the changes) #1 introducing nd= as an alternative to mf= rt= for an imaginary hop. This is essemtially the "forward" signing scheme that Tobias suggested viz instead of: i=1; d=example.com; [email protected] [email protected]; f=..flags..; i=2; d=esp.tld; [email protected]; [email protected];f=..flags..; hide the imaginary hop (because the ESP is creating both signatures) i=1; d=example.com; nd=esp.tld; f=..flags..; i=2; d=esp.tld; [email protected]; [email protected];f=..flags..; similarly for a mailbox provider that forwards for vanity domains i=1; d=example.com; [email protected]; [email protected]; i=2; d=vanity.com; nd=mailbox1.tld; i=3; d=mailbox1.tld; [email protected]; [email protected]; #2 Sorting out DSNs There are issues when a DSN flows back along the outgoing path and that outgoing path visits the same system more than once (mail does that sort of thing from time to time). This is fixed by insisting that DSNs always have the header fields present as the email arrived at that hop (so remove evidence of forwarding from the DNS that came in and is being propagated). Also forbid "null recipes" for headers (which do not seem to have a use case) #3 Add the experimental Delivered-To: header field as an exception to signing. Also the exceptions are now in a section of their own rather than being buried away. #4 Added "feedhere" flag so that privacy preserving forwarders can deal with feedback reports (recall -- which are not defined here) do not reveal where email was forwarded. - -- richard @ highwayman . com "Nothing seems the same Still you never see the change from day to day And no-one notices the customs slip away" -----BEGIN PGP SIGNATURE----- Version: PGPsdk version 1.7.1 iQA/AwUBajwrGGHfC/FfW545EQI2eQCfamEJ1pxRYkfIecC2h2wMExaLQ08AoKFZ 5cRP5abSB3iu6QAPy+e7EpGy =et4e -----END PGP SIGNATURE----- _______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
