5 ms·

> However, as the blog rightly points out, having companies sign their emails would be a massive step in the right direction. Isn't this what DKIM was supposed

> However, as the blog rightly points out, having companies sign their emails would be a massive step in the right direction. Isn't this what DKIM was supposed to be?

gsich 8y ago
Yes. But my guess is that even wrong/no signatures will land in your inbox. For Thunderbird there is an addon which will show you the validity of DKIM signatures https://addons.thunderbird.net/thunderbird/addon/dkim-verifier/ https://addons.thunderbird.net/thunderbird/addon/dkim-verifi...
- repolfx 8y ago
  "It depends" There is a sister standard to DKIM called DMARC that lets a domain publish instructions for what to do if unsigned emails are received. It can run in allow, report and deny mode. Report is useful, it asks the recipient to send it back to the domain which is helpful for large networks that may have many people and services sending mail on their behalf. You can use this tool to compare gmail.com (ignore failed signatures) vs google.com (reject) https://dmarcian.com/dmarc-inspector/ https://dmarcian.com/dmarc-inspector/ Thus google.com i.e. Google employee / service email is protected from From header forgery, but consumer Gmail isn't (too many people sending mail from non-Google SMTP servers).
  - Vendan 8y ago
    It's worth noting that ignore/report is for the email server it's destined for. The server is supposed to send reports back to google (mailauth-reports@google.com specifically) about the failures and such.
pilsetnieks 8y ago
DKIM is for an entire domain, not individual addresses, though.
- Vendan 8y ago
  But it can work for individual addresses as well. For instance, gmail uses DKIM. If they only DKIM sign an email if the user is logged in as the address they are trying to send as, then boom, DKIM is proof that the email from is not forged, and the only way to bypass it is to hack the account.
- jhasse 8y ago
  Sure, but why would the SMTP server sign an email with the wrong login?

> However, as the blog rightly points out, having companies sign their emails would be a massive step in the right direction. Isn't this what DKIM was supposed to be?

gsich 8y ago

Yes. But my guess is that even wrong/no signatures will land in your inbox. For Thunderbird there is an addon which will show you the validity of DKIM signatures https://addons.thunderbird.net/thunderbird/addon/dkim-verifier/ https://addons.thunderbird.net/thunderbird/addon/dkim-verifi...

repolfx 8y ago
"It depends" There is a sister standard to DKIM called DMARC that lets a domain publish instructions for what to do if unsigned emails are received. It can run in allow, report and deny mode. Report is useful, it asks the recipient to send it back to the domain which is helpful for large networks that may have many people and services sending mail on their behalf. You can use this tool to compare gmail.com (ignore failed signatures) vs google.com (reject) https://dmarcian.com/dmarc-inspector/ https://dmarcian.com/dmarc-inspector/ Thus google.com i.e. Google employee / service email is protected from From header forgery, but consumer Gmail isn't (too many people sending mail from non-Google SMTP servers).
- Vendan 8y ago
  It's worth noting that ignore/report is for the email server it's destined for. The server is supposed to send reports back to google (mailauth-reports@google.com specifically) about the failures and such.

pilsetnieks 8y ago

DKIM is for an entire domain, not individual addresses, though.

Vendan 8y ago
But it can work for individual addresses as well. For instance, gmail uses DKIM. If they only DKIM sign an email if the user is logged in as the address they are trying to send as, then boom, DKIM is proof that the email from is not forged, and the only way to bypass it is to hack the account.
jhasse 8y ago
Sure, but why would the SMTP server sign an email with the wrong login?