thunderbird / thunderbird/thunderbird-android

DKIM Validation

Open
#2,278 10 comments 7 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

type: enhancement type: security
Dominant language
Kotlin
Stars
14k
Forks
2.8k
Avg merge
3d 3h
Merged PRs (30d)
57

Description

Enhancement request:

DKIM validation.

PGP ensures the identity of the human writing the message, but does not provide proof that the person is contacting you from the address or username from which he or she claims to be contacting you.

Also: DKIM is something I look for in my e-mails (I have DKIM Validator plug-in for Thunderbird). Much like even the most basic TLS cert by Let's Encrypt, the presence of a DKIM signature makes the originating web server a little more legitimate.

Deployment is not universal, but it is very good as a secondary and/or fallback signature on mail so that people can be sure of authorship and so that less than scrupulous politicians with horrible IT opsec cannot disavow everything.

With the robust and fast signatures of Ed25519 I have faith that DKIM will allow, in the near future, EdDSA in place of RSA and they may become more ubiquitous.

Filing this bug so that progress can be tracked.

Thank you all for your amazing work.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue names no files, tests, or entry points. Start by reviewing the project's current email-authentication behavior and defining the required DKIM validation scope, including the proposed Ed25519 consideration. Done would require an agreed implementation plan and tests proving DKIM signatures are validated, but the issue does not specify those details.

Written by the indexing model from the issue text.

Assessment

Tech stack
kotlin
Domain
mobile-dev, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.