Wietse Venema wrote:
There is no need for the signing party to acquire a secret key
from the author party. To delegate signing from example.com
to isp.com, with d=example.com as a first-party signature:
There is an administrative choice, here. One can delegate a zone or delegate a
private key. The former is more simple, for on-going administrative, but it
leaves less control in the hands of the domain owner.
If the zone is delegated, then the owner does not get to set the TTL for the
signing domain name. If the owner needs to revoke the sub-domain zone, the TTL
might be quite long, before everyone's cache for it flushes.
d/
--
Dave Crocker
Brandenburg InternetWorking
bbiw.net
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html