Subject: Re: [ietf-dkim] Delegated signatures in real life

From: John Levine <[email-masked]>
Date: 31 Aug 2006 03:25:21 -0000

> But the protocol allows the bulk mailer to create any key records
> they like and the protocol as it is written today means that they
> are treated by the infrastructure as equivalent.

I suppose the bulk mailer could forge mail from [email-masked] and
sign it with d=email.orbitz.com, but I don't see why that's any
different from signing it with d=doubleclick.com or any other domain
they control.  The dkim-base treats all d= the same, regardless of
the DNS structure.

What security issue does subdomain delegation introduce here?

R's,
John

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 30 Aug 2006 19:57:14 -0700

But the protocol allows the bulk mailer to create any key records they like and the protocol as it is written today means that they are treated by the infrastructure as equivalent.

The only way that you can avoid this as a sender is not to delegate using NS.

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of J.D. Falk
> Sent: Wednesday, August 30, 2006 5:50 PM
> To: DKIM List
> Subject: Re: [ietf-dkim] Delegated signatures in real life
> 
> On 2006-08-29 16:41, Hallam-Baker, Phillip wrote:
> 
> > Orbitz might not care about the security issues raised by allowing 
> > doubleclick to sign messages on behalf of their CEO and other 
> > executives. Many others will.
> 
> Then they won't delegate the record they use to sign mail 
> from their CEO and other executives.  No problem.
> 
> --
> J.D. Falk, Anti-Spam Product Manager
> Yahoo! Communications Platform Team