Doubts about DKIM verification (RFC6376)

Good morning,

https://www.rfc-editor.org/rfc/rfc6376#section-5 reads:

"Survivability of signatures after transit is not guaranteed, and signatures can fail to verify through no fault of the Signer. Therefore, a Verifier SHOULD NOT treat a message that has one or more bad signatures and no good signatures differently from a message with no signature at all."

What does that exactly mean? That is, for me it seems to be saying that if hash of a message does not correspond to the DKIM public key for a given message, a verifier should behave as there was a sort of no problem at all. It's exaggeration because messages that lack DKIM signature will probably be treated as having at least lower reputation than those that positively passed DKIM verification. But bad DKIM signature is explicit sign that something is wrong with the message.

Can you clarify how above is meant to be understood? It's possible that I miss something as I haven't read this article in its entirety yet and what I quoted seems to be colliding with "6.2. Communicate Verification Results".

Update: reading "6. Verifier Actions" seems to confirm my suppositions which I described in a comment (that Verifier only checks if the DKIM signature is good or bad, but what to actually do with it is to be determined by Identity Assessor and this RFC a kind proposes (although does not enforce) to implement Receiving Server to be Verifier and MUA to be Identity Assessor:

"A border or intermediate MTA MAY verify the message signature(s). An MTA who has performed verification MAY communicate the result of that verification by adding a verification header field to incoming messages."

You have it yourself:

Survivability of signatures after transit is not guaranteed, and signatures can fail to verify through no fault of the Signer.

I read it this way: A sends to C. The message is relayed via B so the flow looks like A->B->C

Party B can take steps (such as stripping off or changing headers) that invalidates the signature. Penalizing party A attempting to the right thing for B's bad behavior makes no sense, and so should be treated no differently then a message without a signature at all.

Pay close attention which cases exactly are compared. Its not comparing

• a valid signature against
• a broken signature

It is merely demanding to treat these cases the same:

• no signatures
• no useful signatures

seems to be saying [..] a verifier should behave as there was a sort of no problem at all

Because there really is no problem with messages having additional signatures. A message having useless signatures should be painless for the sender, because it does not hurt recipient either.

I find it easier to understand why this is a good idea when considering how an optional feature in a diverse environment can succeed at all: if all it offers is an improvement, or nothing. Putting in effort to deploy an optional feature should not come with any downsides - and certainly not when your signature was fine but was broken by someone else.