Hacker News Reader

Comment by upofadown | Hacker News Reader

If you add your own DKIM then you have to mangle the from address to make it appear that the email is from your email domain. Which usually means some sort of "via" usage. So that would not fix the problem.

This is a generic problem with DKIM, it breaks email forwarding.

View on HN

DKIM doesnt break anything because it applies to the original message. You simply forward the signature header (well, you forward everything - thats what makes it forwarding!).

As I mentioned elsewhere, its not clear what the authors intent is - is it an originating server, or is it a relay. In both cases he shouldnt be signing with the relays key, but should either be signing with the domains key (if available) or forwarding the existing signature. Signing with the relays key is all but useless.

>DKIM doesnt break anything because it applies to the message body.

DKIM applies to what you set it to apply to in the DKIM entry. Here is what Gmail signs from the header (the body is signed by default) for their DKIM (taken from a recent Gmail originated message):

    h=Content-Type:List-Subscribe:List-Help:List-Post:List-Archive:
    List-Unsubscribe:List-Id:Subject:To:Message-ID:Date:From:MIME-Version:Sender:
    Reply-To:Cc:Content-Transfer-Encoding:Content-ID:Content-Description:
    Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:
    In-Reply-To:References:List-Owner;

Note the "From" in there along with a whole whack of other fields.

That's a From inside the message. MAIL FROM in the SMTP protocol (envelope from, which you change during forwarding) can be anything else, and DKIM will still validate the message.

Why would you change the from address? The whole point here is to forward, not re-mail. Everything should be forwarded.

I kinda agree with what you said, but the point is that you shouldnt be mangling the from address when forwarding. That will definitely break DKIM, as its actually a required header fields in the sig - but theres NO reason to do that.

p.s. Ive clarified that i meant "original message" not "message body" in my post.

p.p.s Actually, I do think we are in agreement. I mentioned elsewhere that we dont know what the intent was - relay or origin, but in no case should they sign with the relays domain key.

Kind of off the original point but that is where DMARC and SPF come in. This stuff has become a complex unworkable mess.

It is the opposite. Forwarding (can sometimes) break DKIM. If you are reliant on DKIM (such as blocking messages with DMARC) then you need to account for the impact of forwarding. This has been a big problem with mailing lists, since they get caught in the middle. Mail might get blocked because of the signature failed and the mailing list gets blamed.

No, DKIM doesn't break forwarding. If you just forward the message, the original DKIM signature remains correct.

The original DKIM signature breaks if you edit the message body or its existing header fields.

Reply on news.ycombinator.com