The concept is intended to be that the verifying servers would create
a boundary, inside of which mail could be trusted. Such a boundary
could modify headers in such a way that would break signatures in the
assumption that an interior node would trust the boundary. Of
course, the boundary could just add an Authentication-Results: header
(or do something else that would not change the signature) and
something to the user would make such modification.
The primary point of 6.6 is to point out that there are ways to
convey authentication status to an end user in such a way that does
not require modification of the recipient's MUA. That intent can be
clarified.
eric
--On July 20, 2005 10:22:11 AM +0200 Thomas Roessler <tlr(_at_)w3(_dot_)org>
wrote:
In section 6.6, rewriting the From header is suggested as a way to
signal inconsistencies -- such as the ones that could be expected
when messages are forwarded through a mailing list -- to user
agents.
According to section 5.2.2, signing the From header is mandatory.
Hence, if the advice from section 6.6. was applied, DKIM signatures
would be invalidated. User agents would no longer be able to verify
the binding between the signing address (if different from the From
address) and the message.
Regards,