Hi, On 04.09.2026 15:30, Timo Gerke wrote:
Because a signature lifetime (x=) and a cryptographic key validity period serve two fundamentally different operational purposes
If they already serve two fundamentally different operational purposes it would make sense that they're handled by two different layers.
DKIM keys should be handled based on your defined procedures and rules, just like your other key material. Based on the key lifecycle needs you have. You yourself must rotate DKIM keys in the application and update DNS records accordingly.
It also means that it's not and should not be the job of the standard nor assessors to evaluate or enforce your cryptographic policies.
Best, Taavi
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
