datatracker.ietf.org
Sign in
Version 5.4.0, 2014-04-22
Report a bug

DomainKeys Identified Mail (DKIM) Signatures
RFC 4871

Document type: RFC - Proposed Standard (May 2007; Errata)
Obsoleted by RFC 6376
Updated by RFC 5672
Obsoletes RFC 4870
Document stream: IETF
Last updated: 2013-03-02
Other versions: plain text, pdf, html

IETF State: WG Document
Consensus: Unknown
Document shepherd: No shepherd assigned

IESG State: RFC 4871 (Proposed Standard)
Responsible AD: Russ Housley
Send notices to: dkim-chairs@tools.ietf.org

Network Working Group                                          E. Allman
Request for Comments: 4871                                Sendmail, Inc.
Obsoletes: 4870                                                J. Callas
Category: Standards Track                                PGP Corporation
                                                               M. Delany
                                                               M. Libbey
                                                              Yahoo! Inc
                                                               J. Fenton
                                                               M. Thomas
                                                     Cisco Systems, Inc.
                                                                May 2007

              DomainKeys Identified Mail (DKIM) Signatures

Status of This Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The IETF Trust (2007).

Abstract

   DomainKeys Identified Mail (DKIM) defines a domain-level
   authentication framework for email using public-key cryptography and
   key server technology to permit verification of the source and
   contents of messages by either Mail Transfer Agents (MTAs) or Mail
   User Agents (MUAs).  The ultimate goal of this framework is to permit
   a signing domain to assert responsibility for a message, thus
   protecting message signer identity and the integrity of the messages
   they convey while retaining the functionality of Internet email as it
   is known today.  Protection of email identity may assist in the
   global control of "spam" and "phishing".

Allman, et al.              Standards Track                     [Page 1]
RFC 4871                    DKIM Signatures                     May 2007

Table of Contents

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  4
     1.1.  Signing Identity . . . . . . . . . . . . . . . . . . . . .  5
     1.2.  Scalability  . . . . . . . . . . . . . . . . . . . . . . .  5
     1.3.  Simple Key Management  . . . . . . . . . . . . . . . . . .  5
   2.  Terminology and Definitions  . . . . . . . . . . . . . . . . .  5
     2.1.  Signers  . . . . . . . . . . . . . . . . . . . . . . . . .  6
     2.2.  Verifiers  . . . . . . . . . . . . . . . . . . . . . . . .  6
     2.3.  Whitespace . . . . . . . . . . . . . . . . . . . . . . . .  6
     2.4.  Common ABNF Tokens . . . . . . . . . . . . . . . . . . . .  6
     2.5.  Imported ABNF Tokens . . . . . . . . . . . . . . . . . . .  7
     2.6.  DKIM-Quoted-Printable  . . . . . . . . . . . . . . . . . .  7
   3.  Protocol Elements  . . . . . . . . . . . . . . . . . . . . . .  8
     3.1.  Selectors  . . . . . . . . . . . . . . . . . . . . . . . .  8
     3.2.  Tag=Value Lists  . . . . . . . . . . . . . . . . . . . . . 10
     3.3.  Signing and Verification Algorithms  . . . . . . . . . . . 11
     3.4.  Canonicalization . . . . . . . . . . . . . . . . . . . . . 13
     3.5.  The DKIM-Signature Header Field  . . . . . . . . . . . . . 17
     3.6.  Key Management and Representation  . . . . . . . . . . . . 25
     3.7.  Computing the Message Hashes . . . . . . . . . . . . . . . 29
     3.8.  Signing by Parent Domains  . . . . . . . . . . . . . . . . 31
   4.  Semantics of Multiple Signatures . . . . . . . . . . . . . . . 32
     4.1.  Example Scenarios  . . . . . . . . . . . . . . . . . . . . 32
     4.2.  Interpretation . . . . . . . . . . . . . . . . . . . . . . 33
   5.  Signer Actions . . . . . . . . . . . . . . . . . . . . . . . . 34
     5.1.  Determine Whether the Email Should Be Signed and by
           Whom . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
     5.2.  Select a Private Key and Corresponding Selector
           Information  . . . . . . . . . . . . . . . . . . . . . . . 35
     5.3.  Normalize the Message to Prevent Transport Conversions . . 35
     5.4.  Determine the Header Fields to Sign  . . . . . . . . . . . 36
     5.5.  Recommended Signature Content  . . . . . . . . . . . . . . 38
     5.6.  Compute the Message Hash and Signature . . . . . . . . . . 39
     5.7.  Insert the DKIM-Signature Header Field . . . . . . . . . . 40
   6.  Verifier Actions . . . . . . . . . . . . . . . . . . . . . . . 40
     6.1.  Extract Signatures from the Message  . . . . . . . . . . . 41
     6.2.  Communicate Verification Results . . . . . . . . . . . . . 46
     6.3.  Interpret Results/Apply Local Policy . . . . . . . . . . . 47
   7.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 48

[include full document text]