Subject: Re: DMARC: perspectives from a listadmin of large open-source lists

From: "John R. Levine" <[email-masked]>
Date: 16 Apr 2014 00:56:42 -0400

>want to allow modification of the subject field (e.g., adding a tag)
>and/or the body (e.g., adding header and footer) - then you might have
>to be a little cleverer, perhaps by providing information about the
>diffs in extra headers and doing a few comparisons at the receiving end
>(subject tag = *****<original-signed-subject>).

That's unlikely to be a productive direction to go.  We had a lot of 
arguments about message modification when we were designing the DKIM 
strict and loose message digests.  We never found a way to allow subject 
tags that wouldn't also enable all sorts of abuse, and I don't think we 
missed anything.

The reasonable way to use DKIM with mailing lists has always been for
the list to add its own signature, and to use the list signatures to
develop a (presumably good) reputation for the list so its mail gets
delivered.  See the signatures on the messages from this list for an
example.

R's,
John

---

From: Miles Fidelman <[email-masked]>
Date: Wed, 16 Apr 2014 08:21:34 -0400

John R. Levine wrote:
> strict and loose message digests.  We never found a way to allow 
> subject tags that wouldn't also enable all sorts of abuse, and I don't 
> think we missed anything.
>

I was thinking about combining:
- two signatures: at origination, by the list manager
- adding an additional header, along the lines of "original-subject"
- allowing for:
-- not breaking validation of the originating signature
-- adding tags to the subject line (and copying the original subject to 
original-subject)
-- adding a new signature at the mailing list
-- validating the original signature at receipt (just using the 
original-subject header in place of the tagged subject line)
-- doing a diff on the two subject lines to validate that the only thing 
added was a text tag before the original subject

Doesn't address the non-aligned From: header issue, but does reduce one 
impact.

-- 
In theory, there is no difference between theory and practice.
In practice, there is.   .... Yogi Berra