On Fri, Sep 18, 2026, at 18:26, David Conradie wrote: > I’m in agreement with Tobias in not especially liking > donotmodify/donotexplode as part of DKIM2. +1 to this: > > “DKIM2 authenticates what happened and who took responsibility for it. > A separate policy layer can express what a sender would prefer to happen. > Local receiver policy and recipient decisions remain authoritative.”
Right now mailing lists look at DMARC policy and either choose to rewrite the From address or to not modify the message at all. I do believe we need something, right from the start, which gives the same level of signal for DKIM2 to intermediates. Yes, at the end local policy on the receiver trumps everything else, but I think we're over-optimising for the security gateway at recipient end at the expense of the sender intent here. Paypal-et-al really REALLY need a way to indicate that particular parts of their message MUST NOT be modified for the message to be in any way similar to what they sent. If we hand wave this, we're going to create ourselves a pretty solid attack vector. HAVING SAID THAT - DKIM2 still provides a ton of protection because you can't just replay a message that you got a copy of, because you can't sign as a domain on its path. But the threat model is still something like this. Service "X" is used to generate invoices. Bad actor "B" gets "X" to generate an invoice to "B". They then rewrite the message, providing a recipe and all, and forward it to victim "V". "V" gets a message which is a legitimate invoice from "X" with modifications along the way. If their systems say "Invoice from X, dkim2=pass, fully valid" then this a totally compliant DKIM2 chain. Give "B" a compelling sounding lookalike domain, you've got yourself a social engineering friendly DKIM2 abuse vector. Have all invoices from "X" say `donotmodify` , you close this vector. Bron. -- Bron Gondwana, CEO, Fastmail Pty Ltd / Fastmail US LLC [email protected]
_______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
