From: russell@coker.com.au (Russell Coker)
Date: Mon, 22 Aug 2016 17:06:26 +1000
Subject: [refpolicy] DKIM signatures
In-Reply-To: <20160819151708.GA19958@meriadoc.perfinion.com>
References: <201608011139.07442.russell@coker.com.au>
	<8086640.4ebLZzpxHe@russell.coker.com.au>
	<20160819151708.GA19958@meriadoc.perfinion.com>
Message-ID: <4329309.ud7AqAsXlR@russell.coker.com.au>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On Friday, 19 August 2016 11:17:08 PM AEST Jason Zaman wrote:
> Do you happen to know how other big lists handle DKIM and SPF and stuff
> like that? doesnt LKML prefix the subject and stuff on their mails too?
> 
> I just realized my dkim records are not in my DNS but i thought i'd set
> it up. I guess I have one more item on my todo list now :P

Mailman (which is used by this list) has a configuration option to replace the 
From: field with the address of the list server.  I believe that this is the 
correct thing to do as list mail does not come from the sender but from the 
list server.

When a list preserves the From: field it has to preserve the Subject: (which 
means no [refpolicy] prefix) and adding a footer is incompatible with any DKIM 
sender that doesn't use the l= flag.  Given that most senders don't use l= and 
most users don't have the ability to change their DKIM configuration this 
pretty much excludes a list footer unless you change the From: field.

Also the list server needs to not reformat the message or mime encode it for 
best compatability.  There are sender options to relax formatting checks that 
should allow mime-coding the message body to not break the signature, but 
again we are at the problem of most users being unable to change their 
configuration.

Of the minority of users who are able to change their DKIM configuration (IE 
having access to DNS records and DKIM daemon configuration) most of them don't 
have the skill to tweak all the settings themselves.

As an aside I was unsubscribed from this list for a coupe of weeks.  
Presumably because of DKIM failures.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/