Re: just a test

[Alessandro Vesely <vesely@xxxxxxx>]

On Mon 18/Jul/2022 16:27:53 +0200 Charles E. Lehner wrote:
> On Sun, 17 Jul 2022 12:00:59 +0200 Alessandro Vesely <vesely@xxxxxxx> wrote:
>
> > So your version of OpenDKIM handles ed25519.
> Cool.

IIRC released OpenDKIM versions didn't do ed25519, and the versions 
which did it only did it if compiled against OpenSSL (not GnuTLS).

> > > >      dkim=neutral header.d=tana.it header.i=@tana.it
> > > > header.a=rsa-sha256 header.s=delta header.b=Dfpy1mDS;
> > There is no t=s in delta._domainkey.tana.it.  Since the verification
Oops, I meant t=y
> > failed it should've been temperror too.
> OK, interesting. Where does t=s come into this?

The tag t=y in the record defines test mode.  RFC 8601 suggests to 
deliver neutral instead of error in this case.

> > No, ed25519 only admits 256-bit keys.  That's the main reason why
> > DKIM adopted it, after the difficulties of entering long keys in the
> > DSN.
> Hm. Looks like a mistake then that the result from DNSWL says 512-bit key for epsilon (ed25519-sha256)?

Yes.


Best
Ale