3 ms·

DKIM doesnt break anything because it applies to the original message. You simply forward the signature header (well, you forward everything - thats what makes

DKIM doesnt break anything because it applies to the original message. You simply forward the signature header (well, you forward everything - thats what makes it forwarding!). As I mentioned elsewhere, its not clear what the authors intent is - is it an originating server, or is it a relay. In both cases he shouldnt be signing with the relays key, but should either be signing with the domains key (if available) or forwarding the existing signature. Signing with the relays key is all but useless.

upofadown 6y ago
>DKIM doesnt break anything because it applies to the message body. DKIM applies to what you set it to apply to in the DKIM entry. Here is what Gmail signs from the header (the body is signed by default) for their DKIM (taken from a recent Gmail originated message): h=Content-Type:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:Subject:To:Message-ID:Date:From:MIME-Version:Sender: Reply-To:Cc:Content-Transfer-Encoding:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: In-Reply-To:References:List-Owner; Note the "From" in there along with a whole whack of other fields.
- megous 6y ago
  That's a From inside the message. MAIL FROM in the SMTP protocol (envelope from, which you change during forwarding) can be anything else, and DKIM will still validate the message.
- supermatt 6y ago
  Why would you change the from address? The whole point here is to forward, not re-mail. Everything should be forwarded. I kinda agree with what you said, but the point is that you shouldnt be mangling the from address when forwarding. That will definitely break DKIM, as its actually a required header fields in the sig - but theres NO reason to do that. p.s. Ive clarified that i meant "original message" not "message body" in my post. p.p.s Actually, I do think we are in agreement. I mentioned elsewhere that we dont know what the intent was - relay or origin, but in no case should they sign with the relays domain key.
  - upofadown 6y ago
    Kind of off the original point but that is where DMARC and SPF come in. This stuff has become a complex unworkable mess.

upofadown 6y ago

>DKIM doesnt break anything because it applies to the message body. DKIM applies to what you set it to apply to in the DKIM entry. Here is what Gmail signs from the header (the body is signed by default) for their DKIM (taken from a recent Gmail originated message): h=Content-Type:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:Subject:To:Message-ID:Date:From:MIME-Version:Sender: Reply-To:Cc:Content-Transfer-Encoding:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: In-Reply-To:References:List-Owner; Note the "From" in there along with a whole whack of other fields.

megous 6y ago
That's a From inside the message. MAIL FROM in the SMTP protocol (envelope from, which you change during forwarding) can be anything else, and DKIM will still validate the message.
supermatt 6y ago
Why would you change the from address? The whole point here is to forward, not re-mail. Everything should be forwarded. I kinda agree with what you said, but the point is that you shouldnt be mangling the from address when forwarding. That will definitely break DKIM, as its actually a required header fields in the sig - but theres NO reason to do that. p.s. Ive clarified that i meant "original message" not "message body" in my post. p.p.s Actually, I do think we are in agreement. I mentioned elsewhere that we dont know what the intent was - relay or origin, but in no case should they sign with the relays domain key.
- upofadown 6y ago
  Kind of off the original point but that is where DMARC and SPF come in. This stuff has become a complex unworkable mess.