Theo wrote:
Along with the return path, they should change the Sender: just as
mailing lists should if they choose the be hostile to messages.
Even if Yahoo publish "all Yahoo mail has a DK sigature", I will not check
Yahoo's DK signature if the message
1) directly comes from a Yahoo server (because it's surely valid),
2) is forwarded and the forwarder added a Sender header,
3) comes through a broken legitimate forwarder that modifies the message
but does not add a Sender header,
4) comes through a mailing list and the mailing list added a Sender header,
5) comes through a broken legitimate mailing list that modifies the message
but does not add a Sender header,
6) comes from a spammer and the Sender header is not Yahoo.
7) It makes sense to check Yahoo's DK signature only if the mail comes from
a spammer and the 2822 Sender is Yahoo.
But spammers are not so stupid to add a Yahoo Sender header and it is not
possible to distiguish 7) from 3) and 5) by DK alone. So I think that DK is
quite useless.
Roger