Re: [dmarc-ietf] third party authorization, not, was non-mailing list

[Jim Fenton <[e-mail]>]

On 8/25/20 7:39 PM, John Levine wrote:
> In article <[e-mail]> you write:
>>> If the list is [e-mail], does the signature have to be
>>> d=lists.foo.org?  How about d=foo.org?
>>>
>> This seems like an analogous situation to the DKIM i= flag, where the
>> domain MUST be the same as, or a subdomain of, the value of the d= flag.
>> So I'd recommend allowing d=foo.org.
> Well, OK, how about d=org?  This is the opposite of i=, superdomains rather than subdomains.


I see it as being in the same direction as i=, because we're talking
about being able to sign with a superdomain of [whatever identifier] in
both cases. But it doesn't really matter.

In principle, d=org would work too. The identified domain (list domain,
i=, whatever) always has to trust all higher level domains: because they
delegate the DNS to the lower level, they could in principle add their
own selector records if they wanted to spoof the subdomain. But I
haven't ever heard of that being a problem.

-Jim