DomainKeys Identified Mail
|This article needs additional citations for verification. (August 2014)|
|Internet protocol suite|
DomainKeys Identified Mail (DKIM) is an email validation system designed to detect email spoofing by providing a mechanism to allow receiving mail exchangers to check that incoming mail from a domain is authorized by that domain's administrators and that the email (including attachments) has not been modified during transport. A digital signature included with the message can be validated by the recipient using the signer's public key published in the DNS. In technical terms, DKIM is a technique to authorize the domain name which is associated with a message through cryptographic authentication.
DKIM is the result of merging DomainKeys and Identified Internet Mail. This merged specification has been the basis for a series of IETF standards-track specifications and support documents which eventually resulted in STD 76 (aka RFC 6376).
- 1 Overview
- 2 Advantages
- 3 Weaknesses
- 4 See also
- 5 References
- 6 Further reading
- 7 External links
Both modules, signing and verifying, are usually part of a mail transfer agent (MTA). The signing organization can be a direct handler of the message, such as the author, the originating sending site or an intermediary along the transit path, or an indirect handler such as an independent service that is providing assistance to a direct handler. In most cases, the signing module acts on behalf of the author organization or the originating service provider by inserting a DKIM-Signature: header field. The verifying module typically acts on behalf of the receiver organization.
The need for this type of validated identification arose because spam often has forged addresses and content. For example, a spam message may claim in its "From:" header field to be from email@example.com, although it is not actually from that address, and the spammer's goal is to convince the recipient to accept and to read the email. Because the email is not from the example.com domain, complaining there is not useful. It also becomes difficult for recipients to establish whether to trust or distrust any particular domain, and system administrators may have to deal with complaints about spam that appears to have originated from their systems but did not.
DKIM is independent of Simple Mail Transfer Protocol (SMTP) routing aspects in that it operates on the RFC 5322 message—the transported mail's header and body—not the SMTP envelope defined in RFC 5321. Hence the DKIM signature survives basic relaying across multiple MTAs.
DKIM allows the signer to distinguish its legitimate mail stream. It does not directly prevent or disclose abusive behavior. This ability to distinguish legitimate mail from potentially forged mail has benefits for recipients of e-mail as well as senders, and "DKIM awareness" is programmed into some e-mail software.
How it works
The "DKIM-Signature" header field consists of a list of "tag=value" parts. Tags are short, usually only one or two letters. The most relevant ones are b for the actual digital signature of the contents (headers and body) of the mail message, bh for the body hash, d for the signing domain, and s for the selector. The default parameters for the authentication mechanism are to use SHA-256 as the cryptographic hash and RSA as the public key encryption scheme, and encode the encrypted hash using Base64.
The receiving SMTP server uses the domain name and the selector to perform a DNS lookup. For example, given the signature
DKIM-Signature: v=1; a=rsa-sha256; d=example.net; s=brisbane; c=relaxed/simple; q=dns/txt; l=1234; t=1117574938; x=1118006938; h=from:to:subject:date:keywords:keywords; bh=MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI=; b=dzdVyOfAKCdLXdJOc9G2q8LoXSlEniSbav+yuU4zGeeruD00lszZ VoG4ZHRNiYzR
A verifier queries the TXT resource record type of
brisbane._domainkey.example.net. There are no CAs nor revocation lists involved in DKIM key management, and the selector is a straightforward method to allow signers to add and remove keys whenever they wish—long lasting signatures for archival purposes are outside DKIM's scope. Some more tags are visible in the example:
- v is the version,
- a is the signing algorithm,
- c is the canonicalization algorithm(s) for header and body,
- q is the default query method,
- l is the length of the canonicalized part of the body that has been signed,
- t is the signature timestamp,
- x is its expire time, and
- h is the list of signed header fields, repeated for fields that occur multiple times.
Note that the DKIM-Signature header field itself is always implicitly included in h, with the value of the b tag treated as though it were an empty string.
The data returned from the query is also a list of tag-value pairs. It includes the domain's public key, along with other key usage tokens and flags. The receiver can use this to then decrypt the hash value in the header field and at the same time recalculate the hash value for the mail message (headers and body) that was received. If the two values match, this cryptographically proves that the mail was signed by the indicated domain and has not been tampered with in transit.
Signature verification failure does not force rejection of the message. Instead, the precise reasons why the authenticity of the message could not be proven should be made available to downstream and upstream processes. Methods for doing so may include sending back an FBL message, or adding an Authentication-Results header field to the message as described in RFC 7001.
The original DomainKeys was designed by Mark Delany of Yahoo! and enhanced through comments from many others since 2004. It is specified in Historic RFC 4870, superseded by Standards Track RFC 4871, DomainKeys Identified Mail (DKIM) Signatures; both published in May 2007. A number of clarifications and conceptualizations were collected thereafter and specified in RFC 5672, August 2009, in the form of corrections to the existing specification. In September 2011, RFC 6376 merged and updated the latter two documents, while preserving the substance of the DKIM protocol. Public key compatibility with the earlier DomainKeys is also possible.
DKIM was initially produced by an informal industry consortium and was then submitted for enhancement and standardization by the IETF DKIM Working Group, chaired by Barry Leiba and Stephen Farrell, with Eric Allman of sendmail, Jon Callas of PGP Corporation, Mark Delany and Miles Libbey of Yahoo!, and Jim Fenton and Michael Thomas of Cisco Systems attributed as primary authors.
Source code development of one common library is led by The OpenDKIM Project, following the most recent protocol additions, and licensing under the New BSD License.
DomainKeys is covered by U.S. Patent 6,986,049 assigned to Yahoo! Inc. For the purpose of the DKIM IETF Working Group, Yahoo! released the now obsolete DK library under a dual license scheme: the DomainKeys Patent License Agreement v1.2, an unsigned version of which can still be found, and GNU General Public License v2.0 (and no other version).
The primary advantage of this system for e-mail recipients is it allows the signing domain to reliably identify a stream of legitimate email, thereby allowing domain-based blacklists and whitelists to be more effective. This is also likely to make some kinds of phishing attacks easier to detect.
There are some incentives for mail senders to sign outgoing e-mail:
- It allows a great reduction in abuse desk work for DKIM-enabled domains if e-mail receivers use the DKIM system to identify forged e-mail messages claiming to be from that domain.
- The domain owner can then focus its abuse team energies on its own users who actually are making inappropriate use of that domain.
Use with spam filtering
DKIM is a method of labeling a message, and it does not itself filter or identify spam. However, widespread use of DKIM can prevent spammers from forging the source address of their messages, a technique they commonly employ today. If spammers are forced to show a correct source domain, other filtering techniques can work more effectively. In particular, the source domain can feed into a reputation system to better identify spam. Conversely, DKIM can make it easier to identify mail that is known not to be spam and need not be filtered. If a receiving system has a whitelist of known good sending domains, either locally maintained or from third party certifiers, it can skip the filtering on signed mail from those domains, and perhaps filter the remaining mail more aggressively.
DKIM can be useful as an anti-phishing technology. Mailers in heavily phished domains can sign their mail to show that it is genuine. Recipients can take the absence of a valid signature on mail from those domains to be an indication that the mail is probably forged. The best way to determine the set of domains that merit this degree of scrutiny remains an open question; DKIM has an optional feature called ADSP that lets authors that sign all their mail self-identify, but the effectiveness of this approach is questionable, and ADSP was demoted to historic status in November 2013
Working with eBay and PayPal, Google has effectively utilized DKIM in GMail in such a way that any e-mail that claims to be coming from ebay.com or PayPal.com will not be accepted at all if they cannot be verified successfully with DKIM. Such messages won't even appear in the Spam folder. Heavily phished domains that deserve such treatment are few in number, far less than those who publish strict policies.
Because it is implemented using DNS records and an added RFC 5322 header field, DKIM is compatible with the existing e-mail infrastructure. In particular, it is transparent to existing e-mail systems that lack DKIM support.
DKIM requires cryptographic checksums to be generated for each message sent through a mail server, which results in computational overhead not otherwise required for e-mail delivery. This additional computational overhead is a hallmark of digital postmarks, making sending bulk spam more (computationally) expensive. This facet of DKIM may look similar to hashcash, except that the receiver side verification is not a negligible amount of work.
|This section needs additional citations for verification. (February 2013)|
The RFC itself identifies a number of potential attack vectors.
DKIM signatures do not encompass the message envelope, which holds the return-path and message recipients. Since DKIM does not attempt to protect against mis-addressing, this does not affect its utility. A concern for any cryptographic solution would be message replay abuse, which bypasses techniques that currently limit the level of abuse from larger domains [clarification needed]. Replay can be inferred by using per-message public keys, tracking the DNS queries for those keys and filtering out the high number of queries due to e-mail being sent to large mailing lists or malicious queries by bad actors. For a comparison of different methods also addressing this problem see e-mail authentication.
As mentioned above, authentication is not the same as abuse prevention: DKIM doesn't prevent a spammer from composing an ad at a reputable domain so as to obtain a signed copy of the message[clarification needed]. Using an l tag in a signature makes doctoring such messages even easier. The signed copy can then be forwarded to millions of recipients, e.g. through a botnet, without control. The email provider who signed the message can block the offending user, but cannot stop the diffusion of already signed messages. The validity of signatures in such messages can be limited by always including an expiration time tag in signatures, or by revoking a public key periodically or upon a notification of an incident. Effectiveness of the scenario can be limited by filtering outgoing mail, ensuring that messages potentially useful to spammers are not being signed, or just not sent.
DKIM currently features two canonicalization algorithms, simple and relaxed, neither of which is MIME-aware. Mail servers can legitimately convert to a different character set, and often document this with X-MIME-Autoconverted header fields. In addition, servers in certain circumstances have to rewrite the MIME structure, thereby altering the preamble, the epilogue, and entity boundaries, any of which breaks DKIM signatures. Only plain text messages written in us-ascii, provided that MIME header fields are not signed, enjoy the robustness that end-to-end integrity requires.
The OpenDKIM Project organized a data collection involving 21 mail servers and millions of messages. 92.3% of observed signatures were successfully verified, a success rate that drops slightly (90.5%) when only mailing list traffic is considered.
Annotations by mailing lists
The problems might be exacerbated when filtering or relaying software adds actual changes to a message. Without specific precaution implemented by the sender, the footer addition operated by most mailing lists and many central antivirus solutions will break the DKIM signature. The precaution is to sign only designated number of bytes of the message body. It is indicated by l tag in DKIM-Signature header. Anything added beyond the specified length of the message body is not taken into account while calculating DKIM signature. If the l is not used, alternative workaround is to whitelist known forwarders, e.g. by SPF. As another workaround, a forwarder can verify the signature, modify the e-mail, and re-sign the message with a Sender: header. However, it should be noted that this solution has its risk with forwarded 3rd party signed messages received at SMTP receivers supporting the RFC 5617 ADSP protocol. Thus, in practice, the receiving server still has to whitelist known message streams.
Some suggest that these limitations could be addressed by combining DKIM with SPF, because SPF (which breaks when messages are forwarded) is immune to modifications of the e-mail data, and mailing lists typically use their own sender and/or bounce email address, also known as Return-Path. In short, SPF might work without problems where DKIM might run into difficulties, and vice versa. Using both SPF and DKIM is considered the best practice, as e.g. Gmail does. As both methods are dependent on genuine DNS records, it is desirable to safeguard DNS records with DNSSEC, to prevent DNS spoofing.
Short key vulnerability
In October 2012, Wired reported that mathematician Zach Harris detected and demonstrated an email source spoofing vulnerability with short DKIM keys for the
google.com corporate domain, as well as several other high profile domains. He stated that authentication with 384-bit keys can be factored in as little as 24 hours "on my laptop," and 512-bit keys, in about 72 hours with cloud computing resources. Harris found that many organizations sign email with such short keys; he factored them all and notified the organizations of the vulnerability. He states that 768-bit keys could be factored with access to very large amounts of computing power, so he suggests that DKIM signing should use key lengths greater than 1,024. Wired stated that Harris reported, and Google confirmed, that they began using new longer keys soon after his disclosure. According to RFC6376 the receiving party must be able to validate signatures with keys ranging from 512 bits to 2048 bits, thus usage of keys shorter than 512 bits might be incompatible and shall be avoided. The RFC6376 also states that signers must use keys of at least 1024 bits for long-lived keys, though long-livingness is not specified there.
- Author Domain Signing Practices
- Domain-based Message Authentication, Reporting and Conformance (DMARC)
- E-mail authentication
- Sender Policy Framework
- Vouch by Reference
- Jim Fenton (15 June 2009). "DomainKeys Identified Mail (DKIM) Grows Significantly". Cisco. Retrieved 28 October 2014.
- "STD 76, RFC 6376 on DomainKeys Identified Mail (DKIM) Signatures". IETF. 11 July 2013. Retrieved 12 July 2013.
RFC 6376 has been elevated to Internet Standard.
- Delany, Mark (May 22, 2007). "One small step for email, one giant leap for Internet safety". Yahoo! corporate blog. Delany is credited as Chief Architect, inventor of DomainKeys.
- Taylor, Brad (July 8, 2008). "Fighting phishing with eBay and Paypal". Gmail Blog.
- "I’m having trouble sending messages in Gmail". Gmail Help entry, mentioning DKIM support when sending.
- Mueller, Rob (August 13, 2009). "All outbound email now being DKIM signed". Fastmail blog.
- "Yahoo! DomainKeys Patent License Agreement v1.1". SourceForge. 2006. Retrieved 2010-05-30.
Yahoo! DomainKeys Patent License Agreement v1.2
- Levine, John R. (January 25, 2010). "IPR disclosures, was Collecting re-chartering questions". ietf-dkim mailing list. Mutual Internet Practices Association. Retrieved 2010-05-30.
The reference to the GPL looks to me like it only covers the old Sourceforge DK library, which I don't think anyone uses any more. The patent, which is what's important, is covered by a separate license that Yahoo wrote.
- Chen, Andy (September 26, 2011). "Yahoo! Inc.'s Statement about IPR related to RFC 6376". IPR disclosure. IETF. Retrieved 3 October 2011.
- Falk, J.D. (March 17, 2009). "Searching for Truth in DKIM". CircleID.
- Barry Leiba (2013-11-25). "Change the status of ADSP (RFC 5617) to Historic". IETF. Retrieved 13 March 2015.
- John Levine (2 June 2010). "shared drop lists". IETF DKIM Discussion List. mipassoc. Retrieved 1 July 2013.
At this point my published drop list contains PayPal domains, who publish ADSP, and eBay and Amazon who don't publish ADSP, but who send transaction mail all of which is as far as I can tell signed.
- Tony Hansen; Dave Crocker; Phillip Hallam-Baker (July 2009). DomainKeys Identified Mail (DKIM) Service Overview. IETF. RFC 5585. https://tools.ietf.org/html/rfc5585. Retrieved 1 July 2013.
- Roic, Alessio (July 5, 2007). "Postmarking: helping the fight against spam". Microsoft Office Outlook Blog.
- "Security considerations", ietf.org
- Ned Freed (with agreement by John Klensin) (March 5, 2010). "secdir review of draft-ietf-yam-rfc1652bis-03". YAM mailing list. IETF. Retrieved 2010-05-30.
DKIM WG opted for canonical form simplicity over a canonical form that's robust in the face of encoding changes. It was their engineering choice to make and they made it.
- RFC 2045 allows a parameter value to be either a token or a quoted-string, e.g. in format="flowed" the quotes can be legally removed, which breaks DKIM signatures.
- Kucherawy, Murray (March 28, 2011). "RFC4871 Implementation Report". IETF. Retrieved 2012-02-18.
- Zetter, Kim (October 24, 2012). "How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole". Wired. Accessed October 24, 2012.
- RFC 4686 Analysis of Threats Motivating DomainKeys Identified Mail (DKIM)
- RFC 4871 DomainKeys Identified Mail (DKIM) Signatures Proposed Standard
- RFC 5617 DomainKeys Identified Mail (DKIM) Author Domain Signing Practices (ADSP)
- RFC 5585 DomainKeys Identified Mail (DKIM) Service Overview
- RFC 5672 RFC 4871 DomainKeys Identified Mail (DKIM) Signatures—Update
- RFC 5863 DKIM Development, Deployment, and Operations
- RFC 6376 DomainKeys Identified Mail (DKIM) Signatures Draft Standard
- RFC 6377 DomainKeys Identified Mail (DKIM) and Mailing Lists
- DomainKeys Identified Mail (DKIM)
- IETF DKIM working group (started 2006, concluded 2011)
- Internet Messaging Leaders Work Together to Fight Email Fraud
- DKIM Software and Services Deployment Reports
- DKIM-Reputation Project Open reputation data on sender domains
- Crocker, Dave (March 2008). "Trust in Email Begins With Authentication" (PDF). Messaging Anti-Abuse Working Group.
- DKIM implementation for .NET (MIT license)
- DKIM implementation for quick integration with javamail (BSD license)
- DKIM Signature and verification using DKIMproxy DKIM protocol description and integration with Postfix on Debian
- DKIM signer/verifier drop-in replacement for qmail-queue
- OpenDKIM Open source DKIM library, and signing/verifying filter for Sendmail and Postfix
- libdkim++ Open source DKIM C++ library
- Perl's Mail::DKIM
- DKIM signing and validation plugin for Qpsmtpd
- Exim Documentation: Support for DKIM (DomainKeys)