On Sun, Mar 30, 2025 at 2:54 PM Rob Sayre <sayrer@xxxxxxxxx> wrote:
Well, if you have a MUST NOT, it's normative, right? That's not about the ABNF, but about the protocol, which you refer to with "We also said..."."In particular, cryptographic signature verification failures MUST NOT provoke 4xx SMTP replies."
At a protocol level, DKIM operates just fine without knowing anything about SMTP at all. Only the message payload matters, and what you get back from it is a set of zero or more domain names whose signatures were present and passed. That, too, has nothing to do with SMTP.
At an advice level, there are some useful things to say about SMTP, such as what you cited here and also something I saw about 5xx replies, and an implementer needs to understand what SMTP says in order for that advice to be meaningful. That's why there's a normative reference from DKIM to SMTP.
But it doesn't make sense for any SMTP technical specification (i.e., RFC5321bis) to include a normative reference to DKIM. SMTP, the protocol, works just fine without DKIM. The applicability statement, which is not a technical specification, could make such a reference in the "on the modern Internet, this is a consideration" sense, but again I don't think it ought to be a normative one for reasons I gave elsewhere.
-MSK
-- last-call mailing list -- last-call@xxxxxxxx To unsubscribe send an email to last-call-leave@xxxxxxxx
