I posted concerns about DKIM's effectiveness in protecting
against spoofing:
<http://www.imc.org/ietf-mailsig/mail-archive/msg01559.html>
<http://www.mhonarc.org/archive/html/ietf-mailsig/2005-07/msg00310.html>
Mike provided a response indicating that such concerns should
be addressed in the next revision of the draft(s):
<http://www.imc.org/ietf-mailsig/mail-archive/msg01601.html>
<http://www.mhonarc.org/archive/html/ietf-mailsig/2005-07/msg00352.html>
However, after further examination of the Sender Signing Policy draft,
<http://mipassoc.org/mass/specs/draft-allman-dkim-ssp-00-03dc.html>,
I'm not sure such concerns will be fully addressed.
Quoting from SSP:
Sender Signing Policy Checks MUST be based on the Originator
Address. If the message contains a valid signature on behalf of the
Originator Address no Sender Signing Policy Check need be performed:
the verifier SHOULD NOT look up the Sender Signing Policy and the
message SHOULD be considered non-Suspicious.
(Sec. 4)
If this wording stays as-is, then the spoofing example I provided
will go undetected since the signature will be valid and the
verifier is not required to check the Sender Signing Policy
of the Originator Address.
--ewh
--
Earl Hood, <earl(_at_)earlhood(_dot_)com>
Web: <http://www.earlhood.com/>
PGP Public Key: <http://www.earlhood.com/gpgpubkey.txt>