Subject: Re: [ietf-dkim] 822/2822 or just 2822

From: Dave Crocker <[email-masked]>
Date: Tue, 22 Aug 2006 19:34:20 -0700

[email-masked] wrote:
>> Signing at the MUA offers less value and will likely see a higher level of
>> failure.  There are many reasons to caution about signing at the MUA.
> 
> I agree that MUA signing is more problematic for a bunch of different
> reasons, but this is only a question of degree. The same basic problems exist
> at both ends.

I finally figured out what I wanted to say about the question of MUA signing or
validating:

DKIM needs to support signing and validating by MUAs, when the intervening
systems -- and especially the MSA, MDA and Boundary MTAs -- permit.

It is important that we document that there are difficulties in many
environments. Some do great violence to the message; others do little or none.
DKIM need not attempt to provide remedies to those or require that those
environments be changed.

We might want to document examples that work easily and others that are
virtually certain not to work.  Again, however, this is education rather than
specification.  At most, it might provide some guidance, for sites wishing to
make MUA signing or validation work better.

d/

-- 

  Dave Crocker
  Brandenburg InternetWorking
  bbiw.net

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Frank Ellermann <[email-masked]>
Date: Thu, 24 Aug 2006 09:28:15 +0200

Dave Crocker wrote:
 
> We might want to document examples that work easily and
> others that are virtually certain not to work.

For the MSA case "MAY add sender" won't work if the MUA signed
that there is no Sender.  Otherwise I think that RFC 4409 is
no problem for MUAs wishing to sign their mails.

With BURL or BDAT tricks the MUA would know that it can't sign
something that it has never seen or sent.  Was that Lemonade ?
Maybe forward your question to this WG wrt the sending side.

I vaguely recall an MMS-SMTP gateway RFC, that could be also
relevant for DKIM, but it's unrelated to signing MUAs.

> Again, however, this is education rather than specification.
> At most, it might provide some guidance, for sites wishing to

No "however" or "at most" IMO, education is really important.

Frank

---

From: <[email-masked]>
Date: Thu, 24 Aug 2006 09:36:11 -0400

MUA signing would be a useful feature to sell someone. If the associated
sending MTA were MUA signing aware it could bypass the "Send off to the
DKIM Signer rule" and forward the message to the receiver. In some
respects this might be very beneficial taking CPU cycles off of a DKIM
machine. It will take a lot of co-ordination or an end to end solution
provided by proprietary providers. We might need to document a best
practices on how best to do this,

Bill Oxley 
Messaging Engineer 
Cox Communications, Inc. 
Alpharetta GA 
[email-masked] 

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Dave Crocker
Sent: Tuesday, August 22, 2006 10:34 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [ietf-dkim] 822/2822 or just 2822

> reasons, but this is only a question of degree. The same basic
problems exist

I finally figured out what I wanted to say about the question of MUA
signing or
validating:

DKIM needs to support signing and validating by MUAs, when the
intervening
systems -- and especially the MSA, MDA and Boundary MTAs -- permit.

It is important that we document that there are difficulties in many
environments. Some do great violence to the message; others do little or
none.
DKIM need not attempt to provide remedies to those or require that those
environments be changed.

We might want to document examples that work easily and others that are
virtually certain not to work.  Again, however, this is education rather
than
specification.  At most, it might provide some guidance, for sites
wishing to
make MUA signing or validation work better.

d/

-- 

  Dave Crocker