RFC 6377 — DKIM and mailing lists

RFC 6377 is a Best Current Practice document for mailing list operators who do not want to break DKIM signatures.

It is worth reading for a reason its authors could not have intended: it was published in 2011, before DMARC existed, and it describes the mailing-list problem clearly at a point when the consequences were mild. DMARC did not create that problem — it made an existing one expensive.

What it recommends

The advice to list operators is mostly restraint:

• Do not modify what is signed. Subject tags and body footers are the two most common list features and both invalidate a signature.
• If you must modify, re-sign as the list domain, so at least one valid signature exists on the message that leaves.
• Prefer relaxed canonicalization, which tolerates whitespace and header-case changes that would otherwise break simple.
• Consider what the list is for. An announcement list has no reason to modify messages at all.

Why it did not solve the problem

Re-signing as the list domain produces a valid DKIM signature — for the list. Under DMARC that signature does not align with the author’s From: domain, so the message still fails.

This is the core of the interoperability problem catalogued in RFC 7960, and it is why many lists eventually rewrite the From: header to their own address. That works, and it makes the list rather than the author appear to be the sender, which most people dislike.

What to do with it

If you run a mailing list, follow it — the advice is sound and costs little. If you are a domain owner watching list traffic fail DMARC, this document explains why the list operator’s options are all bad, which is useful context before asking them to change anything.

Read it: rfc-editor.org/rfc/rfc6377