Hi Richard, Thanks for the response.
> Increasingly they will find that their ability to deliver their mail to many > large mailbox providers (the Yahoo/Google initiative has now been taken up by > many others) will suffer Understood, and that trend is exactly the concern that motivated my questions. > There is no provision in DKIM2 to not use DKIM2 (which seems kind of obvious > to me and I wonder why you ask) I should clarify. I was not suggesting a carve-out within DKIM2 itself. MBPs chose to make an exception for small senders when rolling out the DMARC Yahoogle requirements. If they take the same approach with DKIM2, a substantial population of DKIM1-signed mail would remain in circulation. Does that leave the DKIM Replay attack conditions that motivated DKIM2 largely in place, or does DKIM2's replay-mitigation goal only require enforcement above a certain volume threshold? I would like to understand whether universal deployment is a design requirement or if a tiered implementation suffices. My concern about this presumes that the 5321.From and 5322.From will need to align at i=1. I don't believe this is required under the current draft, but Tobias and Pietro's recent alignment threads suggest this group is moving toward requiring i=1 alignment. Am I reading that trajectory correctly? > there is work elsewhere to try and work with registrars to allow that type of > activity to be outsourced to authorised people (such as their ESP) Are you referring to existing tools/vendors, or is there an IETF group focused on this effort? I'll admit to being skeptical that a registrar-level solution addresses the range of situations we've seen, but I'd like to learn more. Thanks, Matthew Cool, Matthew Mailchimp Delivery & Deliverability On Sun, Aug 16, 2026 at 5:15 PM Richard Clayton <[email protected]> wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > In message <[email protected] > il.com>, Grove, Matthew <[email protected]> > writes > > >Under the 2024 Google/Yahoo bulk sender rollout, senders sending at ~5k > >messages per day or more were required to publish a DMARC record and to > >satisfy DKIM alignment with their 5322.From domain. In our data, roughly > >20% of senders above that volume have not completed the required DNS > >changes, even two years later. > > Increasingly they will find that their ability to deliver their mail to > many large mailbox providers (the Yahoo/Google initiative has now been > taken up by many others) will suffer -- particularly when spammers have > hijacked their domains or if they send from IP address ranges with a low > reputation > > >What solutions will be available to these senders under DKIM2? > > There is no provision in DKIM2 to not use DKIM2 (which seems kind of > obvious to me and I wonder why you ask) > > >I ask because the drafts I have read appear to assume that a sender who > >wants their mail to be delivered can either administer their own DNS or > >hire someone who can. The senders I have described can do neither, and they > >are a meaningful fraction of the population we represent. I would > >appreciate the working group's current thinking on the path forward for > >them. > > the requirement is to publish a DKIM key -- which means, at its > simplest, that they need to be able to insert a CNAME into their DNS... > and (as is well-known) there is work elsewhere to try and work with > registrars to allow that type of activity to be outsourced to authorised > people (such as their ESP) > > >I would also note that we expect this concern to grow if and as this > >standard is applied to senders below the ~5k/day threshold. > > I would also note that some of the (mow many) participants in "Yahoogle" > do not set hard limits of 5K but "know a bulk sender when they see one" > and you will also find that some mailbox providers have requirements > that apply to all senders not just bulk senders. > > - -- > richard @ highwayman . com "Nothing seems the same > Still you never see the change from day to day > And no-one notices the customs slip away" > > -----BEGIN PGP SIGNATURE----- > Version: PGPsdk version 1.7.1 > > iQA/AwUBaoImrWHfC/FfW545EQJLFQCcDZvlWN7fE/267+Cg3V64/TOu+lYAnjdC > 571+y0uAccPeZZbaVZCXno2e > =ztm1 > -----END PGP SIGNATURE----- > > _______________________________________________ > Ietf-dkim mailing list -- [email protected] > To unsubscribe send an email to [email protected] _______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
