DKIM2 and DMARCbis Have Landed
a day ago
- #standards update
- #authentication protocols
- #email security
- DKIM2 is a new version of DKIM that creates a verifiable chain of custody for emails, ensuring signatures remain valid through forwarding and preventing replay attacks.
- DMARCbis is the successor to DMARC, replacing the static Public Suffix List with a live DNS tree walk and retiring ineffective tags, while incorporating operational improvements.
- Stalwart v0.16.12 is the first mail server to fully implement both DKIM2 and DMARCbis, with a web-based playground for testing authentication without installation.
- DKIM2 addresses issues like replay attacks by including envelope information in signatures, and forwarding breakage via reversible recipes that allow verifiers to undo changes.
- DMARCbis simplifies policy enforcement with a testing flag (t), closes spoofing gaps for non-existent subdomains (np), and allows public suffix operators to declare their status (psd).
- The protocols are backward compatible, with existing DKIM and DMARC records remaining functional, enabling a gradual migration without disruption.