Hi All, and Hi Tobias, While reading both the current specification and the DKIM2 BCP draft, I came away with the understanding that the intended trust model is that a DKIM2 chain starts with a DKIM2 originator. In particular, the current BCP seems to discourage a DKIM2-capable forwarder from introducing a DKIM1-only message into the DKIM2 ecosystem, unless I'm misunderstanding its intent. That's why your question caught my attention. Is the current specification intentionally leaving this undefined for now, or is the expectation that a DKIM1 message should never become the starting point of a DKIM2 chain?
Regards, Pietro Mauri Da: Tobias Herkula <[email protected]> Inviato: mercoledì 15 luglio 2026 22:51 A: ietf-dkim <[email protected]> Oggetto: [Ietf-dkim] Another question: introducing DKIM2 for non-DKIM2 originators Questa è la prima volta che ricevi un'email da questo mittente. Assicurati che sia qualcuno di cui ti fidi. Hi all, One more observation from my reading of the draft. I noticed that I couldn't find any guidance on introducing DKIM2 for messages originating from systems that are not DKIM2-aware. The draft appears to assume that the trust chain starts at the originator, which intuitively seems like the cleaner model to me. However, I could also imagine deployments where the first DKIM2-capable MTA attempts to introduce an existing message into the DKIM2 ecosystem. If such a deployment is not intended, I think it might be worth stating that explicitly. If it is intended, I would have expected the draft to discuss the associated trust semantics and what exactly the first DKIM2 signature is asserting in that situation. I'm not advocating for introducing this capability-in fact, my expectation was that the trust chain should begin with the originator. I was simply surprised that I couldn't find any text confirming or rejecting this deployment model. Regards, Tobias -- Questo messaggio e' stato analizzato con Libraesva ESG ed e' risultato non infetto. Clicca qui per segnalarlo come spam.<https://mail2.mcnsrl.it/action/4h0pHY3dRtzH20H/report-as-bad> Clicca qui per metterlo in blocklist<https://mail2.mcnsrl.it/action/4h0pHY3dRtzH20H/blocklist>
_______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
