Dňa 3. novembra 2023 16:18:05 UTC používateľ Chris Siebenmann via Exim-users <exim-users@???> napísal:
>(In practice it's very rare and generally alarming to see multiple
>instances of most headers.)
AFAIK it was way to trick MUAs to show different value in eg.
From: or Subject: fields. Without oversign, some MUAs will
even show that message as with valid DKIM... Nowadays
it is IMO considered as sender/signer configuration mistake
(do not oversign crucial headers).
>In Exim, the no-prefix case signs the header whether or not it's
Yes, in enough recent version it is enough configurable, but
requires to define own "rule" for headers selection to sign.
>As you note, a sensible Exim default might be to use = a lot more than
>the current settings.
IMO select proper defaults is hard, as it depends. Old DKIM RFC defined
exact headers, recent version step down from exact list and is vague in
that. AFAIK there are two defaults defined as macros, and both are based
on old RFC headers list, but IMO no one is really usable as is.
If one select too few headers to sign, message can be resend modified,
but DKIM still can be valid. If one signs/oversigns too many headers,
legitimate flow can break DKIM, and message can have delivery
problem. Especially in general purpose case, it can be hard to satisfy
all flows...
As it is hard to define universal headers list (that is as i understand that
RFC's step down too), it can be worth to choose another approach for
exim default:
+ make that headers list unset (empty) by default
+ force admins to define own list -- do not sign & log panic if unset, or
even strong, consider it as config error and leave message in queue
And leave current macros just as examples...
>My impression is that Sender is relatively obscure now. It was
It is not common, but it has reason/usage even nowadays -- at least
to have track, who spoofed (possible legitime) From: header. In my
setup, if Sender: appears in message, it is not considered suspicious
(from outside) and i oversign it (from inside).
>These days I believe most MTA setups either block unauthorized From:
>alterations entirely or don't really care about it, so don't force the
>addition of Sender:.
IMO that is not MUA task, MUA has no way to know anything about
which addresses i (user) can use. And, mail is not limited to be send
from advanced MUA, i often compose and send emails from shell or
Python/PHP (which technically is MUA too) without any limitations.
Due that I force From:/Sender: checks at MSA, which has all needed
knowledge for particular authenticated user. As result, no one can
use spoofed nor duplicit From:, Sender: and some other headers
(with some exceptions, but limited in rate).
AFAIK exim adds Sender: header by default when From: differs
from calling user (notSMTP) and it is configurable. It has some
options for that for messages received over SMTP too, check docs
for details.
regards
--
Slavko
https://www.slavino.sk/
--
## subscription configuration (requires account):
##
https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@???
## Exim details at
http://www.exim.org/
## Please use the Wiki with this list -
http://wiki.exim.org/
