[Ietf-dkim] Re: DKIM2 bounce domain alignment q (was Re: Re: Concerns about the recipe/rollback mechanism and deployment architecture in draft-clayton-dkim2-spec)

[Hannah Stern <[e-mail]>]

Hi Bron!

On 4/1/26 22:38, Bron Gondwana wrote:
> On Mon, Mar 30, 2026, at 10:32, Hannah Stern wrote:
>> [... Question stripped ...]

The question was what alignment are we talking about between
an original message and a DSN, and especially why.

> The issue is fake bounces.

> Suppose somebody's email gets leaked (or indeed: forwarded as an 
> attachment) and it has full DKIM2 headers.  Any random domain could pick 
> a random point along the mail flow and send a bounce message, purporting 
> to be from the next hop.  The values would all align.

> Requiring next hop alignment for DSNs means that nobody except the 
> intended receiver can create a DSN for the message.  This means that an 
> arbitrary third party can't create backscatter-esque bounce fraud, and 
> (for example) have the recipient removed from a mailing list by 
> pretending their mailbox has gone away.

Okay, this makes sense.

Now for the what alignment exactly.

If I look at the latest version of the spec we see that the DSN's
"d=" tag in its latest DKIM2 signature has to be "aligned with"
the domain part of one of the "rt=" entries of the original mail
(signature with highest i=).

In the forward path we have two kinds of alignment:
- Domain of new mf= must be the same or a sub-domain below
   the domain of one of the rt= entries of the previous hop
- Domain of new mf= must be the same or a sub-domain below
   the domain stated as d=

This means that the d= of the new hop may be the same as
the domain of one of the previous rt= entries, or it may
be "below" or "above" that.

For previous-hop rt=foo@c.b.a, d= of the new signature may
be d.c.b.a (as long as the new mf= is at or below that domain),
c.b.a (any mf= with correct alignment works), b.a or even a.

But what exact relation between domains do we want between
a DSN d= and an entry in the original rt=?  I.e. how is
"aligned with" mean in this case?

Here we can't go the indirection via mf because the DSN will
have mf=<>.

If we don't want to be stricter than on the forward path,
we'd need to allow the relatively loose relation I derived
above for how previous-hop rt= and d= of the new
signature relate (indirectly, via new mf=).

> Bron.

Hannah.

PS: I hope my word use is correct for domains being "below"
or "above" another domain.  My intention is c.b.a is "below"
b.a, and "above" d.c.b.a.
-- 
Hannah Stern

Software Developer
Mail Transfer Development

1&1 Mail & Media Development & Technology GmbH |  |   |
Phone: [phone]
E-Mail: [e-mail] | Web: www.mail-and-media.com www.gmx.net 
www.web.de www.mail.com www.united-internet-media.de

Hauptsitz Montabaur, Amtsgericht Montabaur, HRB 5452

Geschäftsführer: Alexander Charles, Dr. Michael Hagenau, Thomas Ludwig, 
Dr. Verena Patzelt


Member of United Internet

Diese E-Mail kann vertrauliche und/oder gesetzlich geschützte 
Informationen enthalten. Wenn Sie nicht der bestimmungsgemäße Adressat 
sind oder diese E-Mail irrtümlich erhalten haben, unterrichten Sie bitte 
den Absender und vernichten Sie diese E-Mail. Anderen als dem 
bestimmungsgemäßen Adressaten ist untersagt, diese E-Mail zu speichern, 
weiterzuleiten oder ihren Inhalt auf welche Weise auch immer zu verwenden.

This e-mail may contain confidential and/or privileged information. If 
you are not the intended recipient of this e-mail, you are hereby 
notified that saving, distribution or use of the content of this e-mail 
in any way is prohibited. If you have received this e-mail in error, 
please notify the sender and delete the e-mail.