On Thu, Sep 10, 2026 at 12:26 PM Todd Herr <todd= [email protected]> wrote:
> On Thu, Sep 10, 2026 at 2:57 PM Wei Chuang <weihaw= > [email protected]> wrote: > >> Hi all, >> I've created an Internet-Draft form of this proposal: >> >> DKIM2 Sender Policy >> draft-chuang-dkim2-sender-policy-00 >> >> Abstract >> This document updates DMARC RFC9989 for DKIM2. In particular DKIM2 >> verification supports MTA relay forwarding with message modifications >> through multiple MTAs, so this updates DMARC to support those scenarios as >> well. While DMARC defines a RFC5322 From alignment constraint with an >> enforcement policy if validation fails, this generalizes and separates >> enforcement policy from constraint validation policies. This provides a >> mechanism for MTAs to declare support for DKIM2 through the DMARC DNS >> policy record that helps secure DKIM2 from downgrade attacks. >> >> https://datatracker.ietf.org/doc/draft-chuang-dkim2-sender-policy/ >> >> > It seems like there's something missing in your document, namely an > explicit mention that RFC 9989 is being updated to include DKIM2 as an > Authentication Mechanism, as described in RFC 9989, Section 4.3 - > https://www.rfc-editor.org/info/rfc9989/#authentication-mechanisms > > I believe that Section 1.2.2 in your document, DMARC Authentication with > DKIM2, should explicitly state (all caps for emphasis): > > This modifies DMARC to ADD DKIM2 AS AN AUTHENTICATION MECHANISM FOR > DETERMINING AUTHENTICATED IDENTIFIERS IN DMARC (RFC9989 SECTION 4.3) AND TO > allow SMTP MTA to declare which authentication method it supports to > prevent authentication downgrade or spoofing attacks. > > Agreed this makes sense. I'll update this, and fix the section numbering bug in -00. -Wei > Otherwise, this sentence in the last paragraph of that section makes no > sense: > > Mail Receivers checks the Identifier Alignment as described in [RFC9989 > <https://www.ietf.org/archive/id/draft-chuang-dkim2-sender-policy-00.html#RFC9989>] > Section > 3.2.10 between the RFC5322 From header field Author domain and the DKIM2 > signature d= domain. > > because Section 3.2.10 in RFC 9989 reads: > > DMARC describes the concept of alignment between the Author Domain > <https://www.rfc-editor.org/info/rfc9989/#author-domain> (Section 3.2.2 > <https://www.rfc-editor.org/info/rfc9989/#author-domain>) and an Authenticated > Identifier > <https://www.rfc-editor.org/info/rfc9989/#authenticated-identifiers> (Section > 3.2.1 <https://www.rfc-editor.org/info/rfc9989/#authenticated-identifiers> > ) > > and Section 3.2.1 in RFC 9989 reads: > > Authenticated Identifiers are those domain-level identifiers for which > authorized use is validated using a supported authentication mechanism > <https://www.rfc-editor.org/info/rfc9989/#authentication-mechanisms> (Section > 4.3 <https://www.rfc-editor.org/info/rfc9989/#authentication-mechanisms>) > > So unless section 4.3 in RFC 9989 is updated, I don't see how DMARC > alignment can be checked with DKIM2. > > -- > Todd > >
_______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
