[ietf-dkim] #1398

[Michael Thomas]

Frank Ellermann wrote:
>
>> nothing prevents you from doing an SSP lookup on any address or
>> domain that you desire, so at some level you are accommodated.
>>     
>
> No, it's not obvious what it means if the 2822-From domain claims
> to sign all mails, and the Resent-From domain makes no statement.
>   

In my implementation I can (and do) sign for a configurable set of
addresses including From, Sender, Listid, etc. SSP has the concept
of "I sign everything" which right now is implicitly the From address.
What I'm wondering is whether we should make that binding more
explicit even if we ultimately only choose From, and make it an
extensible list sort of like:

p=sign-complete:From;

Perhaps now, perhaps in the future we could extent that to be
something like:

p=sign-complete:From:Sender:Listid;

Which I'm pretty sure addresses your issue directly.


       Mike