Surely you'd just wrap the entire DKIM2-signed email with encryption? If not, then you're either creating a brand new email and your gateway is implicitly trusted, so NULL recipe or just an Authentication-Results header and no DKIM2 at all.
Or if you're outbound, then you can sign as the sending domain and you just start from scratch with DKIM2 - the fact that it was signed coming to you is just your choice for authentication, you could also have it come in via SMTP-SUBMISSION or whatever works for your environment. DKIM2 doesn't care about the bits where either the start or finish of your mail flow is same or related organisation, because you can verify the message flow out-of-band. And you can't be an encryption gateway in the middle of a mail flow between unrelated parties. What even is that. If you don't have a relationship with either the sender or the recipient, then who verifies the legitimacy of the keys you're using? Bron. On Wed, Jul 8, 2026, at 04:52, Metin Savignano wrote: > Hello everyone, I’m new to this list, please bear with me when ask stupid > question..! > > We are implementing an email encryption gateway, and we are currently looking > at how to implement DKIM properly under these circumstances. The challenge is > > 1. gateway receives a DKIM signed email > 2. gateway can verify DKIM > 3. gateway encrypts emails —> DKIM is broken now > 4. gateway forwards email to the receiving mailserver > 5. mailserver sees a broken DKIM > > Looking at the lastest draft, I am not sure if this scenario has been > considered. I found the null recipe concept, which might be the intended way > to handle this. > > However, using a null recipe seems to break the chain, unless there is > something like a trusted server (or gateway, in this case) that is allowed to > introduce a non-reversible transformation. > > Am I on the right track? > > Thanks > Metin > _______________________________________________ > Ietf-dkim mailing list -- [email protected] > To unsubscribe send an email to [email protected] > > > *Attachments:* > • smime.p7s -- Bron Gondwana, CEO, Fastmail Pty Ltd / Fastmail US LLC [email protected]
_______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
