[ietf-dkim] DKIM signature can mean it's safe to generate bounce?
dotis at mail-abuse.org
Fri Jul 6 18:17:00 PDT 2007
On Jul 6, 2007, at 5:36 PM, Michael Thomas wrote:
> Steve Atkins wrote:
>> If the mail is sent by dick at earthlink.net (or a virus on their
>> machine), with an envelope from address of jane at earthlink.net out
>> through the DKIM stamping earthlink smarthost and you generate a
>> bounce, that bounce will go to Jane.
> Sure, but at least it's reduced to an intra-domain problem which
> earthlink has the capacity to remedy.
Unless Earthlink uses per-user keys, Earthlink will need to wait for
the signature to expire. Even the costly step of invalidating per-
user-keys is not likely to be effective at dealing with a replay
problem. Messages can come from any number of compromised systems
within their network. Nothing within DKIM offers Earthlink the
"capacity" to safely deal with a replay problem.
TPA-SSP offers a means for recipients of Earthlink messages to better
cope with a possible replay problem. When a domain signing a message
has been "authorized" as "strict", the "authorized" domain should
also normally administer the SMTP client transmitting the message to
a public server. By limiting the cases of possible replay abuse,
this containment provides the capacity to better deal with possible
replay problem without resorting to per-user keys.
More information about the ietf-dkim