Re: [Imap-protocol] DKIM signatures on this list

>> The point of a signature is to have a way of verification of the message
>> as sent and received. If "you" received a message from your boss saying "I
>> approve that you spend ten thousand dollars in the company party" and the
>> signature of such message would not validate, that would certainly not be a
>> situation where "you" would say "the correct thing to do is to ignore it."

RFC 6376 is quite clear about what you do with an invalid DKIM
signature -- you ignore it, as though the signature wasn't there at
all.  We deliberately wrote it that way.

It's fine to treat mail with valid signatures differently from mail
without valid signatures, but it's not fine to treat mail with an
invalid signature differently from mail with no signature.  That's why
you shouldn't depend on lists to strip the signatures they break.

I would have hoped that people interested enough in mail software to
be on this list would go to the effort to read and understand the
specs they implement.

R's,
John
_______________________________________________
Imap-protocol mailing list
[email protected]
http://mailman13.u.washington.edu/mailman/listinfo/imap-protocol