-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
In message <CAErdy_G-yb0tq-2TWgtJ7bpnyE_kFUi97QMm3vasGWLpSZ-
[email protected]>, Grove, Matthew <[email protected]
tf.org> writes
>> There is no provision in DKIM2 to not use DKIM2 (which seems kind of obvious
>to me and I wonder why you ask)
>
>I should clarify. I was not suggesting a carve-out within DKIM2
>itself. MBPs chose to make an exception for small senders when rolling
>out the DMARC Yahoogle requirements. If they take the same approach
>with DKIM2, a substantial population of DKIM1-signed mail would remain
>in circulation.
I don't see that that follows at all from the premise that small
businesses are unable to DKIM sign because they cannot update their DNS
DKIM2 uses EXACTLY THE SAME keys as DKIM1 so the only change required is
to their MTA software (or to their ESPs MTA software)
>Does that leave the DKIM Replay attack conditions that
>motivated DKIM2 largely in place, or does DKIM2's replay-mitigation
>goal only require enforcement above a certain volume threshold? I
>would like to understand whether universal deployment is a design
>requirement or if a tiered implementation suffices.
DKIM2 has replay protection, DKIM1 does not ... if people keep on using
DKIM1 for their mail then they risk being replayed ...
... and since I see many dozens of firms (pretty much anyone who allows
UserGeneratedContent in any financial mail they send) being replayed
each week this is not something obscure (ie it's not just DocuSign and
PayPal these days).
>My concern about this presumes that the 5321.From and 5322.From will
>need to align at i=1. I don't believe this is required under the
>current draft, but Tobias and Pietro's recent alignment threads
>suggest this group is moving toward requiring i=1 alignment. Am I
>reading that trajectory correctly?
the current draft does not require alignment... the WG will need to
determine if alignment is the right thing to do -- and there are strong
arguments for requiring it, and no obvious use cases where it cannot be
achieved (again this does not seem at all related to your concerns
about small businesses not being in control of their DNS -- they are
certainly in control of their email header fields)
O am, when not turning round email or driving home from the eclipse,
finalising the next rev of the spec document. That will be followed by
suggested wording to achieve the alignment goal...
>> there is work elsewhere to try and work with registrars to allow that type
>> of
>activity to be outsourced to authorised people (such as their ESP)
>
>Are you referring to existing tools/vendors, or is there an IETF group
>focused on this effort? I'll admit to being skeptical that a
>registrar-level solution addresses the range of situations we've seen,
>but I'd like to learn more.
I do not believe that the work has made it to the IETF yet
- --
richard @ highwayman . com "Nothing seems the same
Still you never see the change from day to day
And no-one notices the customs slip away"
-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1
iQA/AwUBaoN2a2HfC/FfW545EQJ0kwCg7W/cdF2a/hvgnau7SbaDN6UladcAoKR2
jBBHT5iJJ3WsLSPRy56aTgQw
=4oxW
-----END PGP SIGNATURE-----
_______________________________________________
Ietf-dkim mailing list -- [email protected]
To unsubscribe send an email to [email protected]
