News for hackers. Stuff that matters.

A comment on Dear Google Mail Team. Parent comment

Re:Dear Google Mail Team by mike_hearn on Sunday July 19, 2015 @01:41PM (#9912019)
The whole point of DKIM is that messages can be relayed without breaking authentication, because it uses digital signatures instead of sending IP. So I think it wouldn't break
[ Parent | on HN ]
Re:Dear Google Mail Team by massaman_yams on Wednesday July 22, 2015 @01:46PM (#9931130)
... IF the body is not modified, and the header signature matches, AND headers retain DMARC alignment... the reality is that retransmittal (as opposed to just relaying) almost always does one or more of these.

Here's an example from a Google email engineer's recent post to the Mailop list, which is running Mailman software.

Authentication-Results: mx.google.com; spf=neutral (google.com: 2001:41c8:51:83:feff:ff:fe00:a0b is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]; dkim=neutral (body hash did not verify) [email protected]; dmarc=fail (p=REJECT dis=NONE) header.from=google.com

[ Parent | on HN ]
Re:Dear Google Mail Team by mike_hearn on Friday July 24, 2015 @10:59AM (#9942422)
That message says the body was modified. The solution is simple: don't do that. Your original message said DKIM breaks if you simply relay mail, but it isn't correct.
[ Parent | on HN ]