[ietf-dkim] l= statistics was 23 again (sorry John) was Output

[Rolf E. Sonneveld]

Hi, Murray,

On 5/6/11 8:50 PM, Murray S. Kucherawy wrote:
>> -----Original Message-----
>> From: John R. Levine [mailto:johnl at iecc.com]
>> Sent: Friday, May 06, 2011 11:43 AM
>> To: Murray S. Kucherawy
>> Cc: ietf-dkim at mipassoc.org
>> Subject: Re: [ietf-dkim] l= statistics was 23 again (sorry John) was Output
>>
>>>>> +----------+--------------+
>>>>> | count(*) | mailing_list |
>>>>> +----------+--------------+
>>>>> |    77246 |            0 |
>>>>> |    78853 |            1 |
>>>>> +----------+--------------+
>>>> That's just strange.  Most of the l= signatures don't cover the whole
>>>> body, and half of those didn't go through a mailing list?
>>> I suspect it's use of "l=" by a signer without regard to whether or not
>>> the mail is heading to an MLM.  For example, OpenDKIM's antecedent had
>>> that as an option; only the evolution to OpenDKIM allowed you to be more
>>> specific.
>> Except that doesn't explain why l= doesn't cover the entire body.
>>
>> Signing or verifying bug?  Clever spammer replaying signed mail and
>> getting away with it?  Forwarders of some sort that add a footer but
>> otherwise don't look like mailing lists?
> My guess is the third one.  The specification for what we decide is a mailing list submission isn't bulletproof, but is listed as:
>
> - has a "Precedence: list" field
> - has a "List-Id: field
> - has a "List-Post:" field
> - has a "List-Unsubscribe:" field
> - has a "Mailing-List:" field

I assume this is a boolean OR list?

/rolf