-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
In message <[email protected]>, Richard Clayton
<[email protected]> writes
replying to myself ... apologies
>EXCEPT that the auth=dkim2 flag
>is extremely useful to ensure attackers cannot strip headers and get
>old-style behaviour...
>
>Now if it is placed into a DMARC record then this has a cost (finding
>these records is a little complex). I am sanguine about suggesting a new
>record because it is inherently a DNS change for senders and it may or
>may not be simpler to have a new record or a new tag in an existing one.
On reflection this is a dumb comment... the DMARC record is exactly the
place to put auth=dkim2 ... because it is telling a DMARC library that
if there is not a "DKIM2 pass" then there is no authentication and so
the p= instructions should be followed.
As Todd (and doubtless others) have previously observed, a valid DKIM2
message (with RFC5322 From alignment at i=1) is always going to be a
DMARC pass (assuming DKIM2 is allowed as authentication alongside
DKIM1), so the only real value that is achieved by passing the message
to the DMARC library is to get the statistics updated for reporting
- --
richard @ highwayman . com "Nothing seems the same
Still you never see the change from day to day
And no-one notices the customs slip away"
-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1
iQA/AwUBaqrtVGHfC/FfW545EQIdnACcC+plkbNNpUQpTEaF2wc9S16++jgAn2d/
+cQY7/TsebgADr8NJ+qa4kuu
=RlaX
-----END PGP SIGNATURE-----
_______________________________________________
Ietf-dkim mailing list -- [email protected]
To unsubscribe send an email to [email protected]
