Re: Why don't gnu.org and RMS sign mail?

[Alexandre François Garreau]

Le samedi 9 novembre 2019 23:32:59 CET, vous avez écrit :
> Alexandre François Garreau <address@hidden> wrote:
> > Le samedi 9 novembre 2019, 21:44:46 CET Dmitry Alexandrov a écrit :
> >> In the light of yet another letter from your impostor, do you have any
> >> more unresolved questions, that impede you from starting to sign mail? 
> >> Feel free to ask them.> 
> > Note signing can be avoided with effective spf policy.
> 
> No, it can not.  SPF has nothing to do with message headers.  Itʼs an
> antispam measure, that can help to detect fakes when one tries to fake a
> domain name of his _SMTP-server_ (e. g. claim that his 89.184.73.65 is not
> nvs406.mirohost.net but fencepost.gnu.org), but our impostor have not
> bothered to do it.

It is both meant to authentify IP adresses and domains.  So 
nvs406.mirohost.net instead of fencepost.gnu.org stays invalid as of strict 
SPF policy (if DMARC asks to enforce it).

> GPG can be avoided by choosing DKIM instead (+ optionally a DMARC policy),
> but this _is_ a cryptographic signature.

That’s why I didn’t talk about it.