It appears that Timo Gerke <[email protected]> said: >Because a signature lifetime (x=) and a cryptographic key >validity period serve two fundamentally different operational >purposes:
DKIM1 signatures have an expiration time, but DKIM keys do not. We have over 15 years of experience that tells us that this works fine. Keeping in mind that we are making DKIM2 keys the same as DKIM1 keys to ease the transition, you'll need considerably more than "something bad might happen" to make an incompatible change. R's, John PS: > Separating them allows high-security environments (CRITIS) to > strictly enforce automated key rotation cycles at the DNS layer, I rotate my keys every month and have done so for years. Once again, there is nothing to fix here. _______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
