Hello.
One category deserves to be named explicitly here, because it has just
been characterised as noise by volume, and it is not: forwarding.
A legacy forwarder that is not DKIM2-aware and performs SRS rewrites the
envelope MAIL FROM, as it has done for many years to preserve SPF across
forwarding. It does not receive a broken message; it breaks a good one,
by doing exactly what SRS has always done. Structurally this is the same
as a non-DKIM2 list rewriting a Subject: a non-participating node alters
a field the chain covers without declaring it and the seal no longer
verifies at the next hop.
The claim that forwarding is negligible by volume mistakes what
forwarding is. It is not a class of sender that appears as a line on a
dashboard, it is a function embedded throughout the mail system. Any MTA
can forward; any user can set a .forward; any domain can redirect an
alias. Provider "send my mail elsewhere," university and alumni
addresses, corporate gateways, role-address redirection - these are not
a countable population of forwarding servers, they are a capability
present wherever mail already flows. The volume does not show up as
forwarders because it is not senders being counted; it is ordinary mail,
from every kind of sender, passing through a forwarding step on its way.
On the day downstream enforcement is applied, every one of these that
has not become DKIM2-aware turns a message it forwards from deliverable
into a chain-break. In the DKIM2 model a forwarder that rewrites the
envelope declares it and signs the new hop, becoming a link in the
chain. A legacy SRS forwarder does neither, by definition - not because
it is misbehaving, but because it is doing the one thing it was built to
do. Applying "reject on a broken chain" to this population is not a
transition path; it is routine loss of legitimate mail on infrastructure
far larger and far more diffuse than mailing lists.
Regards
Vittorio Moccia
_______________________________________________
Ietf-dkim mailing list -- [email protected]
To unsubscribe send an email to [email protected]
