Subject: [ietf-dkim] Everything not forbidden is permitted

From: Steve Atkins <[email-masked]>
Date: Mon, 3 Aug 2009 16:15:52 -0700

Chatting with people offlist the issue of whether there is such a  
thing as a good or bad DKIM record came up.

I'm trying to get a feel for peoples views on that so, to give a  
concrete example, if your postmaster came to you with this DKIM record  
they wanted you to publish in DNS, would you publish it as-is? If not,  
why not?

september2006._domainkey.example.com 300 IN TXT "version=DKIM1; a=rsa- 
sha1; c=simple/simple; hash=sha1; t=testing; p=MIGfMA0G<more base64  
gunk>;"

Cheers,
   Steve

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: hector <[email-masked]>
Date: Mon, 03 Aug 2009 20:28:56 -0400

The near issue has already come up and the end-result - NO.  A 
customer was asked by their direct marketing spammer to add DKIM/DKEY 
records because YAHOO was forcing the issue on the spammer to access 
YAHOO recipients.

They wanted to signed:

       coupons.majorcompany.com

and ask the company to add DNS selector records.  But the major 
company did have a way to stop fake or 3rd party

       majorcompany.com
       dept.majorcompany.com
       services.majorcompany.com

signatures once bad guys learned that the domain was being signed!

Since DKIM lacks fault detection, the answer was no.

-- 
HLS

---

From: Douglas Otis <[email-masked]>
Date: Tue, 04 Aug 2009 08:13:18 -0700

> Since DKIM lacks fault detection, the answer was no.

The g= tag within the key could limit the local-part of the i= value 
found in the signature header, but would not prevent the use of 
subdomains. This would mean that g=noreply would allow:

  [email-masked]
  [email-masked]
  [email-masked]

and even without the g= restriction the key would not allow:

  majorcompany.com
  dept.majorcompany.com

-Doug

---

From: Tony Hansen <[email-masked]>
Date: Tue, 04 Aug 2009 17:51:42 -0400

I would ask them "Are you aware that this record contains tag keys and 
values that are not part of DKIM?"

If they say yes and can tell me what they're doing, I'd gladly publish 
the record.

If they say no, I'd have a chance to educate them and we'd go through 
the record point by point.

	Tony Hansen