Hi!
If some ADMD wants to have their X-headers authenticated (to themselves,
they're not of value to others), they can add their own MAC/signature
directly to those headers. Or add one "Google-X-Header-Hash: foo"
hashing their X- headers. Which will then be hashed in DKIM2 because it
doesn't start with X-. This is possible because IIRC there's no
prohibition of non-X- extension header fields.
Hannah.
On 5/28/26 20:12, Vittorio wrote:
All,
the current dkim2 specification excludes all X-* headers from the
signed header set. I would like to propose a refinement.
X-* headers fall into two categories with different security
properties. Vendor diagnostic telemetry (X-MS-*, X-GM-* and similar)
is legitimately stripped at domain boundaries and should remain
excluded. Operational metadata (antispam scores, authenticated user
identities, compliance annotations) carries security-relevant
information that an attacker can inject or manipulate without
invalidating the DKIM2 signature under the current blanket exclusion.
The proposed change: replace the blanket X-* exclusion with
prefix-based exclusion. Headers matching well-known vendor diagnostic
prefixes are excluded. All other X-* headers are included in the
signed set. The list of excluded prefixes SHOULD be
operator-configurable.
This is documented in more detail in Section 7.5.1 of
draft-moccia-dkim2-deployment-profile-04 (2026-05-23).
Regards
Vittorio Moccia
_______________________________________________
Ietf-dkim mailing list -- [email protected]
To unsubscribe send an email to [email protected]
--
Hannah Stern
Software Developer
Mail Transfer Development
1&1 Mail & Media Development & Technology GmbH | | |
Phone: +49 721 91374-4519
E-Mail: [email protected] | Web: www.mail-and-media.com www.gmx.net
www.web.de www.mail.com www.united-internet-media.de
Hauptsitz Montabaur, Amtsgericht Montabaur, HRB 5452
Geschäftsführer: Alexander Charles, Dr. Michael Hagenau, Thomas Ludwig, Dr.
Verena Patzelt
Member of United Internet
Diese E-Mail kann vertrauliche und/oder gesetzlich geschützte Informationen
enthalten. Wenn Sie nicht der bestimmungsgemäße Adressat sind oder diese E-Mail
irrtümlich erhalten haben, unterrichten Sie bitte den Absender und vernichten
Sie diese E-Mail. Anderen als dem bestimmungsgemäßen Adressaten ist untersagt,
diese E-Mail zu speichern, weiterzuleiten oder ihren Inhalt auf welche Weise
auch immer zu verwenden.
This e-mail may contain confidential and/or privileged information. If you are
not the intended recipient of this e-mail, you are hereby notified that saving,
distribution or use of the content of this e-mail in any way is prohibited. If
you have received this e-mail in error, please notify the sender and delete the
e-mail.
_______________________________________________
Ietf-dkim mailing list -- [email protected]
To unsubscribe send an email to [email protected]
