CircleID

There's a pernicious meme floating around that DomainKeys Identified Mail (DKIM) doesn't work with discussion lists, particularly those hosted on common open source software packages like MailMan. It's particularly odd to see this claim after I set it up successfully on a stock Debian server in less than half an hour, just a few weeks ago. Here's how it can, should, and does work:

1.  The inbound MTA handles DKIM signature verification, and applies an Authentication-Results header (or a custom X header.) For example, Sendmail's DKIM Milter does this out of the box for Sendmail, Postfix, and other popular MTAs.

2.  If the list /won't/ be modifying the message — in other words, if it acts like a simple forwarder — skip to step 5.

3.  Either the MDA or the list handler strips the DKIM-Signature header, effectively rendering the message unsigned.

4.  The list handler modifies the message in accordance with its configuration, often by adding a footer, placing a tag in the Subject: header, and adding List-* headers.

5.  The MSA or outbound MTA (re-)signs the message. This is appropriate because even if the message is passing through the system unchanged, the list handler is now the Originator, and thus responsible for that message (from a technical perspective, if not in a legal sense). I'd recommend using a different selector (perhaps a different subdomain) for each list, or at least for lists vs. non-list mail from that host, but that's not required.

6.  The outbound MTA transmits the message as per usual.

There's no wacky hacking required — it all works exactly as documented, and exactly as intended.

(Much of the terminology used in this article — MTA, MSA, Originator, et cetera — is defined in draft-crocker-email-arch-15.)

By J.D. Falk, Internet Standards and Governance. Visit the blog maintained by J.D. Falk here.

Related topics: Email, Security, Spam