From caf6aa3b459c73c266d5c7caf66620afb733fbbb Mon Sep 17 00:00:00 2001 From: Jeremy Harris Date: Thu, 17 May 2018 11:18:04 +0100 Subject: [PATCH] Docs: add note on DKIM signing-limit security --- doc/doc-docbook/spec.xfpt | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt index 44022291c..c4b3837da 100644 --- a/doc/doc-docbook/spec.xfpt +++ b/doc/doc-docbook/spec.xfpt @@ -39261,6 +39261,12 @@ strict enforcement should code the check explicitly. The number of signed body bytes. If zero ("0"), the body is unsigned. If no limit was set by the signer, "9999999999999" is returned. This makes sure that this variable always expands to an integer value. +.new +&*Note:*& The presence of the signature tag specifying a signing body length +is one possible route to spoofing of valid DKIM signatures. +A paranoid implementation might wish to regard signature where this variable +shows less than the "no limit" return as being invalid. +.wen .vitem &%$dkim_created%& UNIX timestamp reflecting the date and time when the signature was created. -- 2.25.1