On 04.11.26 11:21, A. Schulze via mailop wrote:
accedently I found a message having 8 DKIM signatures. My DKIM
verifier (OpenDKIM) wrote a log "ignoring 2 signatures". Challenge
accepted! I also found "ignoring 53 signatures"! *)
The number of messages having *many* DKIM signatures is very low. But
the exist.
And for that reason it's good to have a limit like this:
https://manpages.debian.org/trixie/opendkim/opendkim.conf.5.en.html#MaximumSignaturesToVerify
This is also mentioned in RFC 6376, Section 4.2
To limit potential denial-of-service attacks, Verifiers MAY limit the total
number of signatures they will attempt to verify
Have a minute to check that your DKIM validation implementation have
limits implemtent and activated ...
I just want to point out that the default for this is according to opendkim
manpage "3" which I believe should be enough most of the time.
Also, the same doc indicates that signature for domain in From: is always
verified.
--
Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
"Two words: Windows survives." - Craig Mundie, Microsoft senior strategist
"So does syphillis. Good thing we have penicillin." - Matthew Alton
_______________________________________________
mailop mailing list -- [email protected]
To unsubscribe send an email to [email protected]
