Please switch intel.com DKIM signatures to c=relaxed/simple

Please switch intel.com DKIM signatures to c=relaxed/simple

[Konstantin Ryabitsev]

Dear Intel Postmaster:

The intel.com domain has recently started DKIM-signing all outgoing mail,
which is great news, as it helps to add a degree of cryptographic attestation
to smtp-exchanged messages.

Unfortunately, your DKIM c= (canonicalization) setting is currently configured
as simple/simple, which is unnecessarily fragile and will likely result in a
greater degree of quarantined mail, especially for messages traversing a
mailing list service.

To explain, the first "simple" in simple/simple means that the message headers
are signed without any whitespace normalization. If an SMTP-processing gateway
even so much as rewraps a header by adding or deleting newlines (which it is
perfectly allowed per RFC), the DKIM signature will stop validating and the
message will likely be quarantined by the recipient's SMTP gateway. This is
happening right now for any intel.com messages sent via vger.kernel.org --
they are marked as spam by services like Gmail.

So, please reconfigure intel.com's DKIM signature setting to use
c=relaxed/simple. It will have the exact same security effect (nobody cares
about whitespace in headers), and it will greatly improve the lives of many
kernel developers at Intel.

Best regards,
-- 
Konstantin Ryabitsev
Director, Core IT Projects
The Linux Foundation

Re: Please switch intel.com DKIM signatures to c=relaxed/simple

[Konstantin Ryabitsev]

On Tue, 14 Dec 2021 at 10:00, Konstantin Ryabitsev
<konstantin@linuxfoundation.org> wrote:
> So, please reconfigure intel.com's DKIM signature setting to use
> c=relaxed/simple. It will have the exact same security effect (nobody cares
> about whitespace in headers), and it will greatly improve the lives of many
> kernel developers at Intel.

It looks good now, thank you very much for listening! :)

Best regards,
-- 
Konstantin Ryabitsev
Director, IT Core Projects
The Linux Foundation
Montréal, Québec