Douglas Otis wrote:
On Aug 17, 2006, at 8:44 AM, <Bill(_dot_)Oxley(_at_)cox(_dot_)com>
<Bill(_dot_)Oxley(_at_)cox(_dot_)com>
wrote:
Big gaping hole, I may assume that isp.com can determine the
author/originator but how to differentiate or not sign a spoof?
To achieve full isolation, sign all sources with a subdomain signature
or set the t=s flag at the parent domain key. Make only the signing
domain for the sources confirming or constraining the 2822.From
address as a designated domain. A structure something like this can be
used:
- relay-accounts signed with d=relay.example.com.
- mailing-lists signed with d=lists.example.com.
- user accounts signed with d=example.com.
- example.com is the designated domain for example.com.
There is no gaping hole. Filter relay.example and lists.example from
appearing in example.com or set the t=s flag. There can not be any
protection in any arrangement unless the 2822.From addresses are
constrained or validated prior to use. One method that might be used
is to validate each 2822.From per account could be much like that done
for a mail-list subscription.
I really don't think you want to go there. Effectively this would
require "relay" and "lists" to be reserved subdomain names requiring
IANA registration. There's no way that will ever happen.
-Jim
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html