3 ms·
>DKIM doesnt break anything because it applies to the message body. DKIM applies to what you set it to apply to in the DKIM entry. Here is what Gmail signs fro
by upofadown 6y ago
>DKIM doesnt break anything because it applies to the message body.
DKIM applies to what you set it to apply to in the DKIM entry. Here is what Gmail signs from the header (the body is signed by default) for their DKIM (taken from a recent Gmail originated message):
h=Content-Type:List-Subscribe:List-Help:List-Post:List-Archive:
List-Unsubscribe:List-Id:Subject:To:Message-ID:Date:From:MIME-Version:Sender:
Reply-To:Cc:Content-Transfer-Encoding:Content-ID:Content-Description:
Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:
In-Reply-To:References:List-Owner;
Note the "From" in there along with a whole whack of other fields.
- megous 6y agoThat's a From inside the message. MAIL FROM in the SMTP protocol (envelope from, which you change during forwarding) can be anything else, and DKIM will still validate the message.
- supermatt 6y agoWhy would you change the from address? The whole point here is to forward, not re-mail. Everything should be forwarded. I kinda agree with what you said, but the point is that you shouldnt be mangling the from address when forwarding. That will definitely break DKIM, as its actually a required header fields in the sig - but theres NO reason to do that. p.s. Ive clarified that i meant "original message" not "message body" in my post. p.p.s Actually, I do think we are in agreement. I mentioned elsewhere that we dont know what the intent was - relay or origin, but in no case should they sign with the relays domain key.
- upofadown 6y agoKind of off the original point but that is where DMARC and SPF come in. This stuff has become a complex unworkable mess.