Charles Lindsey wrote: > On Sat, 28 Mar 2009 01:09:29 -0000, Jim Fenton <[email protected]> wrote: > > > >> 2. It has been noted that a domain might have different reasons for >> signing a message. It might, for example, sign a message on behalf of a >> mailing list manager operating in that domain. When Author Signature is >> based on a d= comparison alone, any signature from the same domain as >> the author is assumed to be a signature representing the original >> introduction of the message into the mail stream. That may or may not >> be an important distinction, but I'm pointing out that information is >> lost and I'm not sure we have enough experience to say that we don't >> need it. >> > > I don't think that is quite right. Suppose foo.example has declared that > it signs everything, with strength "Discardable". Then four possibilities > arise: > > From: [email protected] From:[email protected] > Valid signature from foo.example Absent/broken signature from > foo.example > ACCEPT DISCARD > > From [email protected] From [email protected] > Valid signature from foo.example Absent/broken signature from > foo.example > ??????? ???????? > > The first two cases are obvious. The second two are Jim's example. What to > do? >
The second two cases are not my example. Concern #2 in my message has to do with messages where the signing address is a different address in the same domain as the From address. The correct test case is: >From [email protected] Valid signature from [email protected] Let's also use "all" instead of "discardable" as the test case because it's the harder problem to solve. As you point out, the mailing list should be acting on the Discardable practice rather than trying to send the message to the list. Let's say that [email protected] is a mailing list that re-signs mail sent to the list (or it could be a forwarder or similar agent). foo.example's mail server gets a message from an address in the same domain, [email protected], that has no Author Signature or has a broken one. In accordance with the domain's policy, it subjects the message to additional scrutiny because of the "all" practices and lack of an Author Signature. The message passes this test and is sent to the mailing list manager. At this point, the mailing list manager would normally sign the message. Let's examine this with the i= and d= choices: Using i= as the basis for Author Signature, the list can sign the message, and the eventual verifier/assessor that does an ADSP check will see that it (still) lacks an Author Signature since [email protected] does not match [email protected]. Using d= as the basis for Author Signature, if the list signs the message, an eventual verifier/assessor will erroneously see that signature as an Author Signature, and therefore might not give the message the desired treatment. Another option would be for the mailing list manager not to sign this message, which means it needs to do a special case not to sign messages if they're from the same domain and lack an Author Signature. This is certainly possible, but would be more challenging if the MTA manages many domains. I also think it's the wrong place to solve the problem. It's up to the WG to decide whether this is a problem that deserves a solution or whether it's too much of a corner case to bother with (mailing list manager with users in the same domain that uses ADSP=all). I do not like the idea of "just change someone's domain" or "just change the list's domain" because it has always been DKIM's goal to operate with existing addresses. Hopefully this clarifies the test case so that this can be evaluated fairly. -Jim _______________________________________________ NOTE WELL: This list operates according to http://mipassoc.org/dkim/ietf-list-rules.html
