It appears that Emanuel Schorsch <[email protected]> said: >-=-=-=-=-=- > >Hello all, > >I am concerned with the phishing implications of recipes. For example, for >irs.gov or paypal.com the phishing potential seems quite high of being able >to modify URLs, dollar amounts, sending instructions or other key >information with recipes and still having a DMARC pass. ...
Seems to me that's what the donotmodify and donotexplode flags are for. Put those on mail that shouldn't be going through mailing lists so there's no reason to munge it. The problem I forsee is that the inept security consultants who tell everyone to put DMARC p=reject on low value domains will tell people to put those flags on all their signatures because it's "more secure." I think a more plausible scenario is that the large providers have their own idea of what's a phish target domain and will treat their signatures as donotmodify even if they don't explicitly say it. R's, John _______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
