On Mon, 12 Oct 2026, William Weiner wrote:
The difference from DKIM1 (your current times comparison) is the i= counter. In DKIM1 a signature says “we signed this.” In DKIM2 i=1 is also a chain position assertion: the verifier is told this is the first hop. A message with References and In-Reply-To headers is not incongruous with a DKIM1 signature; in DKIM2 a verifier following chain logic has legitimate grounds to ask why a message presenting as first-hop has headers that suggest otherwise. .
Whenever I send a reply to a list message, such as this one, it has References and In-Reply-To headers. They're created by the MUA, not by list software. When I add DKIM2 signatures, the i=1 signature will sign those headers. I am aware of a lot of MUAs that add those headers, and no list software that does. I am baffled how anyone who'd ever looked at the headers on inbound or outbound list mail would imagine otherwise.
Once again, there is nothing special about reorigination and no reason to say anything about ir.
Regards, John Levine, [email protected], Taughannock Networks, Trumansburg NY Please consider the environment before reading this e-mail. https://jl.ly _______________________________________________ Ietf-dkim mailing list -- [email protected] To unsubscribe send an email to [email protected]
