Re: [Ietf-dkim] X-Google-DKIM-Signature header field

The purpose of the XGDS signature is so that we can assert that it came
from us, and is used as validation on some of the other fields that we add
and that
are signed by that field and that the contents of the message haven't
changed.   One could probably figure out how to verify it since it re-used
the standard dkim libraries.

We don't want to take "ownership" of the message in the reputation sense,
hence the reason it's not a regular DKIM signature, nor do we want to deal
with any pushback from mail admins because some random places they mail on
the internet refuse messages when DKIM signatures are broken (in
contravention of the spec, yes).

It's also not google.com or any other domain ever used for sending mail so
that any reputation or anything else people figure on this isn't applied
inappropriately.

Ie, it's not uncommon for various providers to add a chunk of usually
base64 encoded data to headers these days, this signature is there for our
chunk when we require it to only apply to uncorrupted original messages.
Well, we probably wouldn't care for "normal" modifications, but it was
added pre-ARC and the loss of usage for cases where messages are harmlessly
modified is fine.  In fact, one of the use cases is for the
X-Original-Authentication-Results (XOAR) header which was a precursor to
ARC, a kind of one-hop ARC.

Brandon

On Tue, Aug 27, 2019 at 2:55 PM Jim Fenton <fenton@bluepopcorn.net> wrote:

> [resending because I needed to correct subscription address. Apologies
> for duplicate if the moderator approves the original.]
>
> I recently got a "welcome" message from a list.nist.gov mailing list
> that is apparently hosted on Google infrastructure. I notice it wasn't
> DKIM signed, but did have a X-Google-DKIM-Signature header field that
> looked like a normal DKIM signature with d=1e100.net (one of Google's
> many domains). Apparently Google doesn't intend that I rely on this
> signature for anything, but does anyone know why they aren't applying a
> normal DKIM signature from 1e100.net here?
>
> -Jim
>
>
> _______________________________________________
> Ietf-dkim mailing list
> Ietf-dkim@ietf.org
> https://www.ietf.org/mailman/listinfo/ietf-dkim
>