Hi Earl,
At 10:43 20-07-2005, Earl Hood wrote:
In the example I provide, no signature failure occurs.
Yes.
Unless I am overlooking something, can you explain to me how
the signature will fail in the example I provided?
I did not say that the signature would fail. :) I assume that it was a pass.
The problem I am raising is the DKIM does not protect the sender/author
address adequately. I.e. It does not allow _me_ to protect my
personal address from getting used by malicious domains.
In the example you provided, your email address is not being used as
the sender's address. We should make a distinction between sender
and author. You can use DKIM to verify whether the email is from the
sender's address.
In your example, there was no sender header in the h tag of the
DKIM-Signature. We can easily verify that the domain in the d tag
does not match the From header and take appropriate action.
Why is this? DKIM does not adequately protect the From: field,
or allow the signed address be different from the signer's domain.
To provide adequate protection, then one or more of
the following should occur:
* The author/sender is allowed to specify which domains are
authorized to sign messages. This could be done via a DNS
lookup on the signed address. If I know I send messages
via certain providers, I can include those providers in
my nameserver.
That sounds somewhat like SPF. DKIM, only needs the private key to
sign a message. I can, for example, sign a message and send it
through a different provider without having to include that
provider's domain in my nameserver.
Regards,
-sm