At 09:31 02-11-2008, Thiyaga wrote:
But if it signs SPAM unknowingly (which may happen in large ISPs --
where few mails get slipped through spam checks), then it creates a
potential loop whole that lots of duplicate SPAM mails can arise out
of it. A spammer can specifically target/exploit this behavior. It
creates the vulnerability of sending SPAM mails with DKIM signed on
behalf of the same domain -- even *without* the knowledge of that
domain by sending through some other spammy domains or botnets!
See Section 8.5 of RFC 4871.
Is there any reason, why we didn't take any possible action/solution
to this issue? If the solution is simple (like the one I mentioned in
my previous mail -- adding outbound MTA's IP or Network to signature),
we could easily make DKIM resilient enough to such attacks and loop
wholes? Please advise.
If DKIM was tied to the outbound's MTA IP address, it would face the
same problems as SPF when it comes to forwarding.
The goal of DKIM is to permit a signing domain to assert
responsibility for a message. If the signing domain is concerned
about its reputation, it should avoid signing messages which may be
viewed as spam. The signer may set a signature expiration to limit
replay attacks.
Regards,
-sm
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html