24 Sep
2017
24 Sep
'17
12:52 p.m.
random832(a)fastmail.com writes:
Do the standards provide a way to allow mailing lists
(or other kinds
of forwarders) to get around this?
They do.
Maybe by having the original mail server digitally
sign the message
and allowing it to be forwarded with the signature intact.
That's called DKIM. :)
An early attempt at protection against forgeries was SPF, which is a way
to tell recipients (by way of DNS) which mail servers are allowed to
send mail from a given domain. That's too simplistic, though, as it
doesn't provide for mailing lists or other forwarders.
Adding DKIM, you get a cryptographic checksum covering a few headers,
and the body of the message. The receiving mail system can use this to
verify that the sender is who the message claims. The bits that are
checksummed have to be intact, though: the mailing list (or other
forwarder) must not modify the From:, To:, Date:, or Subject: headers,
nor the body of the message.
Finally, DMARC is a DNS based way to specify what to do with a message
that claims to be from your domain, but fails both SPF and DKIM
checks -- i.e. it's being delivered by a non-authorized mail system, and
it also lacks a verifiable DKIM signature.
-tih
--
Most people who graduate with CS degrees don't understand the significance
of Lisp. Lisp is the most important idea in computer science. --Alan Kay