-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
In message <[email protected]>, Jim
Fenton <[email protected]> writes
> On 1 Nov 2026, at 18:19, Richard Clayton wrote:
>
>> viz using the subdomain as the Signing Domain.
>
> Do we have an understanding why they do this?
I think (you'd need to ask them to be sure) that the delegation of
subdomains was originally to set up MX records and such (and if you care
about SPF, then placement of those records matters)
So they put their DKIM keys there and DMARC then accommodated them
> The idea of selectors
> was that if you had an ESP that you wanted to sign for you, you
> published a selector record with their public key. I’m guessing now
> that perhaps example.com delegates the entire esp.example.com zone
> to the ESP so that it can rotate its own keys? Could this be done
> with CNAME records instead?
I agree, the issue can be fixed by changing DNS (and yes Selectors is
the way to do it, and CNAMEs is simplest).
However, requiring that senders change DNS in order to use DKIM2 will
seriously impact the likelihood of its adoption -- we looked at the
numbers and it is not just one company that needs to update all their
customers but dozens (probably hundreds). The customer count will run
into the tens or hundreds of thousands -- likely way more.
> Now, I
> understand that a.co.uk could sign for co.uk but not b.co.uk, but I
> ’m still concerned that this “reverse delegation” is not the way
> delegation works.
it isn't ... but the world is full of people who have delegated
esp.example.com and they rather like the fact they can send
authenticated email
> Again, I think that the security aspect should take precedence over
> inconveniencing the ESPs and their customers.
If you take that view we can all go home now, the IETF does not have the
leverage to change what they are doing, however awful.
The ship sailed long ago when DMARC introduced "relaxed" alignment -- I
assume for exactly the same pragmatic reasons.
- --
richard @ highwayman . com "Nothing seems the same
Still you never see the change from day to day
And no-one notices the customs slip away"
-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1
iQA/AwUBauh4d2HfC/FfW545EQJYYgCgtoxi5b3lrQp9sFJhn+4obFqojOQAoI0T
lGGH4ky0FlWcYs8cUw8a0tBK
=OgX2
-----END PGP SIGNATURE-----
_______________________________________________
Ietf-dkim mailing list -- [email protected]
To unsubscribe send an email to [email protected]
