[EAI] SPF and DKIM

["abel" <abelyang at twnic.net.tw>]

Do we discuss those more ?

1. As I know in SPF
    SPF TXT record listed where  my email come from list in this domain ,

    A example in downgrading :
>>ehlo twnic.net.tw
>>mail from: <UTF8 at twnic.net.tw>  ALT-ADDRESS=ASCII at gmail.com  # EAI-aware
>>rcpt to:<UTF8 at other.domain>     # non-EAI-aware

when the downgraded mail transmits , if other.domain run SPF check, we can
pass in SPF helo check ,but fail in SPF  sender check (ascii at gmail.com) if
gmail.com SPF records with -all unless gmail.com adds SPF for us,
but it seems impossilbe to do that.
Fujiwara's downgrade-03 draft said 'more detailed consideration is required'
in Section 5, But I think that SPF sender check will break ALT-ADDRESS
without
restriction.


2. DKIM
    Header change (downgraded / drop ) maybe break the signatures,

a downgraded mail keeps the original header can follow DKIM, but DKIM
should know how to verify and reduction.

2.1 Downgrading after DKIM, some header value has changed by downgrading
   procedue when transmits, DKIM verifier should restores 'Downgraded:'
   header to verify, and all 'Downgraded:' headers are above
'DomainKey-Signature'
   header.
2.2 Downgrading before DKIM, DKIM signs the downgraded headers, it's
possible
   to include 'h=Downgraded:' in 'DomainKey-Signature', all 'Downgraded:'
   headers are under DomainKey-Signature header, DKIM verifier should verify
   all 'Downgraded:' headers if there are 'Downgraded' in tags 'h='

   And we still need to more consideration about the downgrading impact  in
   DomainKey-Signature  tags 'd=' (domain) 'i=' (sender) 'z=' (header name
   and header values in quoted-printable) or more.



If we drops header values (such as uFor or others ) and the headers are
signed in
'DomainKey-Signature' will cause Domain Key verifier  treats as a bad
signature
if they do not appear ,especially in trace field, that's fine in trace filed
rule
and DKIM siner/verifier issue.


_______________________________________________
IMA mailing list
IMA at ietf.org
https://www1.ietf.org/mailman/listinfo/ima