On Monday, May 23, 2011 12:35:02 PM John R. Levine wrote:
> > In the real world signature reliability matters. If a domain signs mail
> > as a rule then an absent or broken signature will be treated as
> > suspicious.
> 
> I hope you're wrong, since that violates an explicit SHOULD in RFC 4871,
> and in my experience, most broken signatures are due to innocent
> modification in transit, not malice.

Which one is that?  AFAIK treating a broken signature the same as no signature 
is what the RFC wants me to do.

> Do you have numbers to show that broken signatures indicate that messages
> are malicious, or spam, or otherwise worse than otherwise?

None that I can share unfortunately.  IME no signature is more suspicious than 
a broken one (as you suggest, I think most breakage is innocent), but putting 
broken and no signature into the same bucket is the most sensible and RFC 
compliant way to approach it.

> For that matter, since we're not talking about ADSP, what do you mean by
> an absent signature?  Do you track which domains sign what mail? How do
> you tell what signature you're expecting?  From line domain? Sender?
> Message ID? Something in the Received lines?

The specific cases (which are non-ADSP) that I'm aware of use the body From as 
a key.

Scott K
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

Reply via email to