New Song: DKIM2
Ali G(mail) is back, and he brought an Internet-Draft. Our new hip-hop track walks through DKIM2 — the IETF's plan to rebuild email authentication around a signed chain of custody — one spec-accurate bar at a time.
Why we made a song about a draft
Because this one matters. DKIM2 is the DKIM working group's proposal to fix the problems DKIM has carried for fifteen years: mailing lists that break signatures by adding a footer, replay attacks that ride a legitimate signature to a million inboxes, and bounces that land on innocent people who never sent anything.
The fix is one idea applied everywhere: a signed chain of custody. Every hop that touches your message signs what it did. Every modification is declared, with a recipe to reverse it. Every bounce goes back exactly one hop, along the chain, to someone who actually handled the message.
Or as the outro puts it: every hop dat change it, signs. Every change declared. Every bounce go home.
Da replay contract
The bar that earns the track its existence:
Da live envelope gotta match da top one exact / Local part and all, dat's da replay contractDKIM1 never signed the SMTP envelope. That's the entire replay problem: a spammer takes one legitimately signed message and re-sends it to recipients the signer never approved — and the signature still verifies, because the signature never said who the mail was for.
DKIM2 closes that door by recording the MAIL FROM and RCPT TO in every hop's signature. The verifier checks the live envelope against the top signature exactly — local part and all. Replay either fails on the spot or forces the replayer to sign their own name into the chain. A trail, all down the chain of custody.
Five minutes, six verses, one spec
The track covers a genuinely absurd amount of the draft: the mandatory tags, the nd= handoff for forwarders, the Message-Instance hashes, Revisers and their base64 JSON recipes, which headers don't get counted, both canonicalizations, the crypto requirements, timestamps, nonces, all five flags — and the new bounce rules that finally kill backscatter.
We verified every bar against the current draft while writing the song page, and the full breakdown lives there: verse-by-verse production notes explaining what each tag actually does, plus a best-practices guide on what senders should do now — because you can't deploy DKIM2 today, but you can absolutely be the sender whose migration is an upgrade instead of a rebuild.
Still a draft, innit
One honest caveat, straight from the intro. DKIM2 is an active Internet-Draft, not an RFC. Tag names, timeouts, and details may still change — and the spec itself is refreshingly blunt about versioning: there's no v= tag at all. If they ever have to break it, they'll just call it DKIM3.
So consider this song a snapshot of the spec as it stands, with a beat behind it. If the draft changes, we'll update the notes. The chorus should survive: hash da body, hash da head, sign da chain.
Big up da IETF massive.
Listen and read the full breakdown →