Hi, Murray,
On 5/6/11 8:50 PM, Murray S. Kucherawy wrote:
-----Original Message-----
From: John R. Levine [mailto:johnl(_at_)iecc(_dot_)com]
Sent: Friday, May 06, 2011 11:43 AM
To: Murray S. Kucherawy
Cc: ietf-dkim(_at_)mipassoc(_dot_)org
Subject: Re: [ietf-dkim] l= statistics was 23 again (sorry John) was Output
+----------+--------------+
| count(*) | mailing_list |
+----------+--------------+
| 77246 | 0 |
| 78853 | 1 |
+----------+--------------+
That's just strange. Most of the l= signatures don't cover the whole
body, and half of those didn't go through a mailing list?
I suspect it's use of "l=" by a signer without regard to whether or not
the mail is heading to an MLM. For example, OpenDKIM's antecedent had
that as an option; only the evolution to OpenDKIM allowed you to be more
specific.
Except that doesn't explain why l= doesn't cover the entire body.
Signing or verifying bug? Clever spammer replaying signed mail and
getting away with it? Forwarders of some sort that add a footer but
otherwise don't look like mailing lists?
My guess is the third one. The specification for what we decide is a mailing
list submission isn't bulletproof, but is listed as:
- has a "Precedence: list" field
- has a "List-Id: field
- has a "List-Post:" field
- has a "List-Unsubscribe:" field
- has a "Mailing-List:" field
I assume this is a boolean OR list?
/rolf
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html