Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add SignHeaders From #48

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add SignHeaders From #48

wants to merge 1 commit into from

Conversation

seriv
Copy link

@seriv seriv commented May 12, 2024

From the man opendkim.conf:
OversignHeaders (dataset)
Specifies a set of header fields that should be included
in all signature header lists (the "h=" tag) once more than
the number of times they were actually present in the signed
message. The set is empty by default.
The purpose of this, and especially of listing an absent
header field, is to prevent the addition of important fields
between the signer and the verifier. Since the verifier would
include that header field when performing verification
if it had been added by an intermediary, the signed message
and the verified message were different and the verification
would fail. Note that listing a field name here and not
listing it in the SignHeaders list is likely to generate
invalid signatures.

From the man opendkim.conf:
   OversignHeaders (dataset)
      Specifies  a  set of header fields that should be included
      in all signature header lists (the "h=" tag) once more than
      the number of times they were actually present in the signed
      message.  The set  is  empty  by  default.
      The purpose of this, and especially of listing an absent
      header field, is to prevent the addition of important fields
      between the signer and the verifier.  Since the verifier would
      include  that  header  field when  performing  verification
      if it had been added by an intermediary, the signed message
      and the verified message were different and the verification
      would fail.  Note that listing a field name here and not
      listing it in the SignHeaders list is likely to generate
      invalid signatures.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant