Larry Rosenman <ler@lerctr.org> writes:
> On 2015-11-24 13:11, Tom Lane wrote:
>> Kevin Grittner <kgrittn@gmail.com> writes:
>>> If this were done, would the other steps (not changing the subject
>>> or body of the email) be necessary?
>>
>> See my followup: I think it's probably true that we could skip those
>> changes.
> Any Header or Body changes will invalidate most, if not all, DKIM
> signatures. Since DKIM is used as part of DMARC, it's a problem.
Yeah, but SPF is also used as part of DMARC, which means that merely
forwarding somebody's email out of our listserv is probably going to look
like spam, even if we didn't change anything at all about the message
contents. Also, some sources sign Reply-To: and/or Sender: (Yahoo,
at least, does the former) which means you can't replace those headers
either without breaking the DKIM signature. The only fix for that is to
rewrite From:, and once you do that I don't see a convincing argument why
you can't also rewrite Subject: and add a footer if you feel like it.
(For context, Rudy had implemented the no-header-change and no-footers
changes on our neighborhood list quite some time ago; the From: changes
and local DKIM-Signature: were the things that went in last week. I'm of
the opinion that he could revert the former now that he's done the latter;
but he seems to think not, for reasons he was not able to explain to me
convincingly. It seems to me that the first two changes were meant to
allow the source's DKIM-Signature to still apply, and now that he's given
up on that strategy, I don't see what they're buying.)
regards, tom lane