Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 27 Nov 2018 23:03:30 +0700
From:      Victor Sudakov <vas@mpeks.tomsk.su>
To:        "John R. Levine" <johnl@iecc.com>
Cc:        freebsd-questions@freebsd.org
Subject:   Re: Invalid DKIM signatures in this list
Message-ID:  <20181127160330.GC78157@admin.sibptus.ru>
In-Reply-To: <alpine.OSX.2.21.1811262122261.73238@ary.qy>
References:  <20181126125259.GB86999@admin.sibptus.ru> <20181126172133.CDCDB2008E6098@ary.qy> <20181127015856.GA79319@admin.sibptus.ru> <alpine.OSX.2.21.1811262122261.73238@ary.qy>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help

--61jdw2sOBCFtR2d/
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

John R. Levine wrote:
>On Tue, 27 Nov 2018, Victor Sudakov wrote:
>> The problem is in FreeBSD's mailing list manager which is broken IMHO.
>
>If you are saying that it's broken because it's not deleting old DKIM
>signtures, I'm sorry, but you're simply mistaken.  I helped write the DKIM
>specs so I'm not guessing here.
>
>> See RFC 6377
>>
>> "The best general recommendation for dealing with MLMs is that the MLM
>>   or an MTA in the MLM's domain apply its own DKIM signature to each
>>   message it forwards and that assessors on the receiving end consider
>>   the MLM's domain signature in making their assessments.  (See
>>   Section 5, especially Section 5.2.)"
>
>I helped write that RFC.  It was and is just guessing.  While it would
>be a good idea for the lists to add their own signature, they're not
>broken if they don't.  And that says nothing about deleting old
>signatures.

With all due respect to you as the co-author of the RFC, it does say=20
something about deleting old signatures.  I'm not quoting for you=20
(this would be odd) but for the general public here who are reading this th=
read.

In "5.7.  Signature Removal Issues" the document says=20

"However, if the MLM is configured to make changes to the message
prior to reposting that would invalidate the original signature(s),
further action is RECOMMENDED to prevent invalidated signatures from
arriving at final recipients, possibly triggering unwarranted filter
actions. "

and it mentions=20

   "5.  Remove all previously evaluated DKIM signatures;"

as one of the possible solutions (among 5 other suggestions).

and then again:

"Removing the original signature(s) seems particularly appropriate
   when the MLM knows it is likely to invalidate any or all of them due
   to the nature of the reformatting it will do.  "


--=20
Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
2:5005/49@fidonet http://vas.tomsk.ru/

--61jdw2sOBCFtR2d/
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEcBAEBAgAGBQJb/WrSAAoJEA2k8lmbXsY0MVYIAKkfYiE/sxD1ya3tw/qEQ8x4
6kydBkhZWxRJ1f18WmEhLW5x6cEyPNcgSRAS/XhxzxCWP/jG1JkvnKvGK909STeD
YoxENYinqOyAE+A6t7ptY8IwFaPEY/zdbgLDbLim/GaLLrDRLTGwEmTKhYgvqUWN
e0eo5a6OOPrbsiNSuSZo9wMbxCCB3xrtb0CxbVhPMuBnz2ie+W8g69RXNSlmos/J
oNMTCr6hn5zBtI9ZlXQs+xc8JRQgx2yYKZUNTXjDI5TaQ8+89GHAAs3dI7ll+bmr
H8eqN+WwU3Kcue9QitUMg9o+YWTrGpaBdIWYK310/XBi5nEOk1s8/g1LseLexcM=
=3MX+
-----END PGP SIGNATURE-----

--61jdw2sOBCFtR2d/--



Want to link to this message? Use this URL: <http://docs.FreeBSD.org/cgi/mid.cgi?20181127160330.GC78157>