Subject: Re: [ietf-dkim] Re: Requirements comment: Bigbank example description

From: Scott Kitterman <[email-masked]>
Date: Thu, 10 Aug 2006 7:02 -0400

On Thu, 10 Aug 2006 06:32:25 -0400 "Hector Santos" <[email-masked]> 
wrote:
>
>----- Original Message ----- 
>From: "william(at)elan.net" <[email-masked]>
>To: "Scott Kitterman" <[email-masked]>
>
>
>> On Wed, 9 Aug 2006, Scott Kitterman wrote:
>> 
>>> On Wednesday 09 August 2006 21:29, Hector Santos wrote:
>>>
>>>> It was my contention that the SSP should ALWAYS be done against the
>>>> 2822.From regardless of how DKIM-Signature domain was bounded.
>>>>
>>> +1
>> 
>> Would you remind me how this would work with multiple address in
>> the From field? [*]
>
>What's wrong with checking each one?  I mean, why allow for a loophole?

First, I see this largely as a design issue, not a requirements issue, if 
it's not just a receiver policy issue.

I would check each one.  I would apply the most result I got.  I.e. if a 
2822.From address had a First Party Expected practice associated with it 
and that signature was missing, I would apply the appropriate receiver 
policy (I'd probably reject it, YMMV).

Scott K
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html