On Wed, Nov 16, 2016 at 11:50 PM, Michael Storz
<Michael(_dot_)Storz(_at_)lrz(_dot_)de>
wrote:
Ok, I see you have removed the hashing of the recipient together with the
email itself. But how do you prevent a replay attack, if the new tag is not
bound to the email and signed with the DKIM-key (that's how I read 4.1.4)?
The spammer could remove the tag or provide his own tag with the new
recipient before resending the email.
The signature signs itself, so removing or changing the tag invalidates the
signature. Have a look at RFC6376, Sections 3.5 and 5.1.
-MSK
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html