On Wed, Jul 29, 2026 at 7:43 AM MCN-IETF <[email protected]> wrote:
> Hi all, > > Following the recent discussion, I started thinking about another aspect > that will eventually need to be addressed. > > John mentioned that one open question is what "alignment" should mean once > a message carries a DKIM2 chain containing signatures from different > domains. > > Today, with DKIM1, the model is straightforward: DMARC evaluates whether > there is at least one aligned DKIM signature (or SPF), and BIMI builds on > that DMARC result. > > With DKIM2, however, the receiver no longer sees a single signer but a > sequence of accountable participants. > > For example: > > i=1, d=example.com (originator) > i=2, d=list.example > i=3, d=forwarder.example > > At that point, what does "DKIM aligned" mean for DMARC? > Agreed with the later comments that DKIM2 doesn't have meaning for DMARC RFC9989 <https://datatracker.ietf.org/doc/html/rfc9989> until that RFC is updated. Currently the direction and even the consensus seem to be to update the BCP with a definition of DKIM2 alignment. At some future point, once the DKIM2 specification settles, we should request an update for the DMARC RFC regarding DKIM2. > Should alignment be satisfied if any valid signature in the chain aligns > with the From domain, or should the chain semantics introduce a different > interpretation? > I've also been asking that (archive link <https://mailarchive.ietf.org/arch/msg/ietf-dkim/5-B3ADeZlnHs-_waiS6ZXFaB5b8/>). I propose that the From domain aligns with the DKIM2 signature's d= domain at the hop i=1 as that is closest to the message author. > The same question seems relevant for BIMI. > > BIMI is not only concerned with authentication, but also with representing > the identity associated with the From domain. Since DKIM2 preserves the > complete chain of responsibility rather than a single signature, I wonder > whether BIMI evaluation should continue to follow the same DMARC alignment > model or whether DKIM2 introduces considerations that have not yet been > discussed. > BIMI is defined in terms of DMARC, so this won't change near term. Alex Brotman raised a concern that DKIM2 permits the message body content to be fully swapped out while still declaring the message authentic. The BIMI folks (such as myself) need to consider that concern. -Wei
_______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
