From my reading, I would assert that it is logical that the check
MUST be made if there is no valid signature on behalf of the from
address. To do otherwise invites abuse.
Why? Nobody I know is saying that any signature gives a message a
free pass, but if it's signed by someone you have reason to trust,
why aren't you done? Could you give us a step-by-step example of
the abuse you're anticipating?
Assume that the signature is from someone you've known and trusted for
20 years, and you've never heard of the From: domain before.
R's,
John
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html