8

DKIM seems to prove that a message came from where it claims to be from. However, OpenPGP encrypts the entire email and signs it which obviously proves it also came from the person it says it did.

Other than dumb systems liking DKIM just because they're built to use it to help stop spam - is there any reason to use it with OpenPGP from a security point of view?

3 Answers 3

11

DKIM and OpenPGP are orthogonal. DKIM proves that a given email really came from the mail server which is specified in one of the Received: headers of the mail. It does not give any guarantee as to the actual human sender; DKIM focuses on the path which the email took. DKIM could be a great tool against some classes of spam, in that mail servers could bo configured to reject all emails which pretend to come from a given domain but do not sport a valid signature proving that they did go through the domain outgoing server (this can thwart domain impersonating spams).

OpenPGP (for signed messages), on the other hand, does not care at all about what servers a given email went through. OpenPGP signatures are about validating the human sender. OpenPGP does nothing against spam. OpenPGP can also add encryption, for data confidentiality, something which DKIM does not offer at all.

Since OpenPGP and DKIM do not offer the same functionalities, and neither does what the other offers, then it can make sense to use both.

5

DKIM only really proves it's from the domain it says it is from. OpenPGP digital signatures can prove from a particular email address anyway (as long as the trust of the public key is valid and the private keys haven't been compromised (same goes for DKIM or any digital signatures based on PKI)), OpenPGP also can show it hasn't been tampered with.

1

Though an edge case, I suppose if the private key was compromised but the e-mail service was not, implementing DKIM would ensure that the adversary trying to make the e-mail appear from the sender would fail.

Also while OpenPGP proves it's a particular key that wrote the message, without DKIM you don't necessarily know that that person owns that particular e-mail address until you go to e-mail that address back.

See also this question.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .