3 ms·

I don't know much about mail servers, but would it be possible to validate the signature somehow before delivering the message? Is this impossible or impractica

• deleted 2y ago
  [deleted]
• thenewnewguy 2y ago
  Even if they did, you could just sign the message for real.
• upofadown 2y ago
  Email signatures are essentially end to end. The company would have to keep a file of all the identities of all the people that everyone in the company knew. To make this useful, the company would also have to record information about who knew who. As already mentioned, the email might also be encrypted (the most common case). Then the signature would not be available as it would be hidden under the encryption. These sorts of filtering issues are why corporate cybersecurity people, somewhat ironically, tend to dislike encrypted email. There is an opportunity here to make better email clients that treat encrypted, but unsigned, emails with suspicion.
• layer8 2y ago
  There is commercial mail server software that does exactly that.
• cmgbhm 2y ago
  PGP doesn’t require the use of global directories so you can’t do strong validation. This is a bypass game on something like proof point url protection that rewrites URLs to go through a central redirect so that reputation check can be separated from reputation delivery, usage detected, and one liner URLs still work. I’m over a decade out of this space so take with a grain of salt. The tool could do a better job inspecting “oh that’s a pgp formatted massage”. You could probably just route them all to spam and almost no one would notice.