At 09:31 02-11-2008, Thiyaga wrote: >But if it signs SPAM unknowingly (which may happen in large ISPs -- >where few mails get slipped through spam checks), then it creates a >potential loop whole that lots of duplicate SPAM mails can arise out >of it. A spammer can specifically target/exploit this behavior. It >creates the vulnerability of sending SPAM mails with DKIM signed on >behalf of the same domain -- even *without* the knowledge of that >domain by sending through some other spammy domains or botnets!
See Section 8.5 of RFC 4871. >Is there any reason, why we didn't take any possible action/solution >to this issue? If the solution is simple (like the one I mentioned in >my previous mail -- adding outbound MTA's IP or Network to signature), >we could easily make DKIM resilient enough to such attacks and loop >wholes? Please advise. If DKIM was tied to the outbound's MTA IP address, it would face the same problems as SPF when it comes to forwarding. The goal of DKIM is to permit a signing domain to assert responsibility for a message. If the signing domain is concerned about its reputation, it should avoid signing messages which may be viewed as spam. The signer may set a signature expiration to limit replay attacks. Regards, -sm _______________________________________________ NOTE WELL: This list operates according to http://mipassoc.org/dkim/ietf-list-rules.html
