7

I currently offer email subscriptions on my blog, something I coded myself in PHP.

People sign up on the blog using their email address. I send them an email with a link to verify their email address and once verified, they get an email whenever a new post is published. I only publish about 4 or 5 posts in a month and every email sent has an unsubscribe link which unsubscribes them right away if they wish. I hate spam so I definitely don't want to send anyone email that they don't want. I'm constantly checking to see if any of the emails bounce (nothing does) and would remove them from the list right away if there was ever a problem. I'm presently not having any problem with the emails being delivered and as far as I know, they're not ending up in people's spam/junk folders. I've set up my VPS box with SPF and DKIM, SSL only, etc… I currently have just under 200 email subscribers.

I'm wondering, is there any reason not to sign these subscription emails with an s/mime certificate? Would it improve deliverability? Or just give people the peace of mind of knowing that the email did in fact come from me?

Also, what about for email receipts? I'm presently working on updating another site, which will have an e-commerce component to it (via Stripe), so I'll be sending a lot of email receipts (I hope!), and also an email newsletter through that site also.

I know that s/mime is not that popular/wide-spread, so would sending these emails signed be a bad idea? (Not encrypted, just signed.) I don't see anyone else doing this, so I'm wondering if it's a bad idea? (Or why isn't anyone else doing it?)

Improve this question

1 Answer 1

Reset to default
8

Signing emails is useful only insofar as recipients verify the signature. Theoretically, signing the emails might improve deliverability, but only if a recipient configures his filters for incoming emails to verify email signatures and accept emails which have been verified to come from you. However, this is only theoretical; in practice, email filtering is not under control of the end user, but done in the email server, and no server verifies S/MIME signatures. In fact, there are some (poorly configured) antispam system who will react negatively to signature (because they don't understand them), so signing emails is probably a bad idea in your case.

Said otherwise: if signing emails improved deliverability, then spammers would do it.

Another general comment is that you should not want to sign. When you sign something, you are actually building a legal weapon aimed against you: a signature can only serve one purpose, which is to rub your data in your own face. If you think clearly about signatures, then you should actively avoid signing anything; what you want is that other people sign what they send to you.

Improve this answer
5
  • Could you please expand on the second comment (about not wanting to sign for legal reasons)? Specifically, wouldn't signing limit claims from the recipient: you sign something so the recipient has less possibilities to say "I received something which seemed to come from you and I clicked and I was hacked" (to which you say "I sign all my emails, this is here in the small print")
    – WoJ
    Commented Apr 15, 2015 at 15:46
  • That you sign something does not mean that you sign everything. You may claim so, but that's just a claim. There is no practical difference, from a legal point of view, between "I swear that I do not send virus to people" and "I swear that I sign everything I send". If you want your signatures to protect you, then you need something else that proves that, indeed, whether you want it or not, everything you send is signed by you. A signature is not such a system.
    – Thomas Pornin
    Commented Apr 15, 2015 at 15:50
  • I am looking at this from the perspective of a cloud provider (say, B2B). If I have a contract and the contract says (in essence) "all emails sent from the platform will be signed" then I shut down the discussions about forged emails mentioned in my comment. On top of that (legal aspects aside), this helps to build an expectation of the format of the email and non-compliant emails are more likely to be simply dismissed by the recipients.
    – WoJ
    Commented Apr 15, 2015 at 15:55
  • Related: simson.net/ref/2004/fc2005_smime_submitted.pdf
    – WoJ
    Commented Apr 15, 2015 at 16:04
  • If I want that only other people sign what they send to me, then other people might want the same from me. So everybody would stop signing mails, right?
    – user1511417
    Commented Dec 7, 2017 at 16:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .