3 ms·
Author does not mention dkim in article which makes me think he might not "read all the relevant RFCs" as he claims. Majority of important emails are signed an
by hamilyon2 8y ago
Author does not mention dkim in article which makes me think he might not "read all the relevant RFCs" as he claims.
Majority of important emails are signed and are not easy to spoof
- Carpetsmoker 8y agoI have updated the article to mention it: > DKIM is useful, but limited. All it does is verify that an email which claims to be from paypal.com is really from paypal.com. What it lacks is the ability to show warnings such as "this email wasn't signed, do you want to trust it?" and "this signature isn't recognized, yikes!" Perhaps such warnings could be accomplished with DKIM somehow (I'd have to study it to see), and if it can: great! But in its current state it's doing something different than what I'm proposing (which is why I omitted it originally).
- jhasse 8y agoWell that UX somehow exists: If DKIM fails, the changes are high the email will be classified as spam or possible phishing.
- TobbenTM 8y agoI think the big issue is that not every email client reacts harshly enough to emails with either no DKIM header or mismatching DKIM signature. Today it's basically just one of several factors for marking a email as spam, when in reality it should show a big-ass red warning.