3 ms·
Used as you suggest, there’s a good chance a fishing/scam email will go through since it only affects spam score. I’ve had several scam emails, including from
by beagle3 6y ago
Used as you suggest, there’s a good chance a fishing/scam email will go through since it only affects spam score.
I’ve had several scam emails, including from @paypal addresses, which did pass my mail service’s filter, but flagged by the DKIM verifier.
I want defense in depth; I’m ok with the occasional visible false warning. Rotating DKIM keys often makes it unusable on the mail client. (Not sure that’s a problem with DKIMs intended use, but if keys are rotated slowly enough - e.g. once a month - it’s usable for that too)
- walrus01 6y agoIf it came from a fake "paypal.com" address but was not received from the MX for paypal.com, your incoming spam filtering has issues other than DKIM... Something like that would get 5+ extra points added to it by a basic spamassassin setup. With a common setup that is postfix + opendkim as a mail filter on the incoming, that should also get caught. I guess the point I was trying to make is that DKIM was really intended to be deployed on the service-provider side, and smtpd mail filtering side, rather than on the client.
- beagle3 6y agoI agree they did something wrong. But I don’t run my own server - and I do run my own client.... And it’s not the MX that says where mail comes from, it’s the SPF record (if you have one). Google had, for a very long time, an issue where any g-suite/gmail user could SPF as any g-suite domain; so servers that didn’t check DKIM (most until recently, and probably still) would let it through happily.