Hector Santos wrote:
ProcessB() - SSP lookup
- Message Arrives
- OA SSP Policy lookup
- EXCLUSIVE
- Two Signers found --> REJECT
I would think ProcessB() is more ideal, more efficient and
100% DKIM/SSP compatible, and more importantly with a
rejection result that is mostly likely to be more correct
than ProcessA() acceptance of an OA domain policy voilation.
IBTD for your "Two Signers found --> REJECT" shortcut. It's
enough to reject it if no signature matches the SSP domain.
BUT I think anything else you said here is correct, and this is
not reflected in the first figure of the "threats" draft. I've
now stated this at least five time, time to get a ticket. Bye
_______________________________________________
ietf-dkim mailing list
http://dkim.org