Re: [dmarc-ietf] Question regarding RFC 8617

[Brandon Long <[e-mail]>]

On Thu, Nov 7, 2019 at 9:28 AM Dave Crocker <[e-mail]> wrote:

> On 11/6/2019 9:43 AM, Brandon Long wrote:
> > What's more, the point of including Subject and other mutable headers is
> > the same as it is for DKIM, those are the headers which are important to
> > the receiver, so they should be validated.
>
>
> This being a technical list, I'm going to get picky and note that DKIM
> does not 'validate' those fields.
>
> There is a derivative data integrity benefit, between signing and
> validated, for such fields, but that is quite different from any claim
> that the contents of those fields are 'valid'.
>
> Some signing sites have much more stringent uses of DKIM than are
> provided by the standard.  That's fine, of course, but it has nothing to
> do with the standard.  Hence any receive-side reliance on such signer
> data validation is outside the DKIM standard.
>

I should have said "covered by the signature".

And I think they are important to both the sender and receiver, your DKIM
RFC calls them "core to the message content" and so the "core of the
message is valid"... which is different than validated, of course.

For ARC, this still holds true, that AMS is analogous DKIM, and should cover
 the core of the message, and ARC allows for you to know if and between
which hops
the core of the message was modified.

Brandon