Mark Martinec writes: > Thanks Justin and Daryl. > > > > (a) Is "From:addr" rather than "EnvelopeFrom:addr" the right header to > > > use? > > I'd say yes. DK signs the message, not the envelope. I'm pretty sure > > the current milters look for a From: header to decide on what > > selector/etc to use. > > Right, DK (as well as DKIM) uses addresses in the header, not envelope. > DK would choose Sender if it exists, otherwise a From, to obtain the > signer domain. DKIM is more sophisticated (could use Resent-From,...), but > basically, for direct mail the From header field is the most important one. > > > (b) are Y! signing all mail? I would have assumed some systems are not > > yet using DK. > > This is a key question here. I'd hope yes, since Yahoo was the leading > proponent in establishing this technology (now aiming for DKIM). > > Although their policy record still says 'testing' and 'signs SOME mail': > > $ host -t txt _domainkey.yahoo.com > t=y\; o=~\; n=http://antispam.yahoo.com/domainkeys > > I think they are just conservative, trying to avoid some broken recipient's > mailer from rejecting their genuine mail, or to avoid problems with mailing > lists invalidating signatures when their user posts there.
OK -- someone who would know, tells me: Pretty much all user-generated mail From: yahoo-owned domains is [now] signed, but that's not intended as a statement of spam/non-spam. Bear in mind the list/forwarding issue I also noted; most list installs don't re-sign mails, so an additional exemption for messages that contain "List-Id" might be worthwhile. mass-check should give a good idea, anyway. Dunno about gmail, yet. --j. > > In 3.1.x, you have to set priority manually, unfortunately, to be higher > > than both of the subrules. in 3.2.x, it'll do that automatically for you. > > Thanks for the info. > > > Personally I'd cut the score in half. > > Ok, perhaps. > > > Slow DNS could cause FPs -- I've seen it happen > > on mail from rogers.com which Y! runs. > > Interesting. Further experience is welcome. The _domainkey.yahoo.com > TXT policy record has TTL set to two hours, and one of their public > keys (s1024._domainkey.yahoo.com) has a lifetime of 24 hours - so a > local caching DNS resolver is likely to retrieve the policy from > its cache, or from any one of the 5 registered Yahoo name servers. > As far as I can tell, it is a global Yahoo thing, not something > pertaining to one or another of their servers. > > What about gmail.com? They seem to be signing their mail too > (see: host -t txt beta._domainkey.gmail.com) but also avoid full > commitment in their policy (no policy => default policy). > Any experience there? > > Mark
