<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>On Feb 15, 2011, at 2:02 PM, Patrick Ben Koetter wrote:</div><div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><span class="Apple-style-span" style="font-family: monospace; ">Hmmm, is it wise to make no difference between an unverified signature and and<br>no signature?</span></span></blockquote></div>RFC 5451 suggests so:<br><div><pre class="newpage"> [<a name="ref-DKIM" id="ref-DKIM">DKIM</a>] advises that if a message fails verification, it should be
treated as an unsigned message.</pre><div>DKIM does not guarantee that the key information will be available in the future, so reverifying messages is problematic. We could implement the logic in Thunderbird, but that's a fair bit of crypto I don't know how to write, and as I mentioned earlier, DKIM verifiers can have a lot of additional configuration to trust certain servers, rewrite headers, handle mailing lists, and so on.</div></div><div><br></div><div>- Alex Reinhart</div></div></body></html>