ietf-dkim
[Top] [All Lists]

Re: [ietf-dkim] Issue #1265: Signing by parent domains

2006-05-29 21:05:12

On May 29, 2006, at 8:07 PM, Barry Leiba wrote:

indeed. which prompts the obvious question: why are folks pursuing this.

And I think the thread has gone on long enough with enough participants for me to say that I see strong consensus that this particular concern is not shared.

This subtopic is closed. Let's look at any other reasons to remove the parent-domain point. Is there one?

It's ugly and it adds significant complexity in analysing the system, and some lesser spec and implementation complexity.

The only valid reason to require it, I think, is for the benefit of users who use wildcard MXes, to enable them to make up subdomains on- the-fly, and who send mail using from addresses in those subdomains. Given that DK puts its information to the left of the domain-cut it's unavoidable in that case. I don't know how widespread this usage of mail sent (not received) with domain parts that map onto wildcard MXes with arbitrary subdomains is. I suspect it doesn't actually happen.

I think that if it's used in other cases it will be a fairly strong sign of bad architectural design on the part of the sender, but there's nothing that obliges a sender to use this misfeature in those cases, and I don't see any security issues with it being supported, other than complexity.

It's an ugly wart, but I see more harm in arguing about it than implementing it.

Cheers,
  Steve


_______________________________________________
NOTE WELL: This list operates according to http://mipassoc.org/dkim/ietf-list-rules.html

<Prev in Thread] Current Thread [Next in Thread>