Ask which signature algorithm signed the message

Answer Ask which signature algorithm signed the message. RFC 8463 specifies ed25519-sha256 as a signature algorithm for DKIM, alongside the algorithms signers were already using. The document adds a method to the menu. It does not sign your solo ad. The signature on the received message is the only place the algorithm name for that message is true.

The note that started this: RFC 8463, A New Cryptographic Signature Method for DKIM, RFC 8463.

Vendors like a new method because it sounds current. Current is a property of a specification. Your send is a property of a platform's settings on a given day. If you use solo ads for affiliate marketing, the affiliate link can be perfect and the signature can still be absent, broken, or signed with a method the vendor's slide never mentioned. Ask for the field.

DKIM, at the level a buyer needs, is a signature over selected parts of the message. If the signature verifies, those parts were not altered after signing, and the domain that signed is the domain in the signature. The algorithm is the mathematical method used to produce that signature. Naming the method without checking verification is naming a tool that might be sitting in a drawer.

What does RFC 8463 add to DKIM?

It specifies an additional signature algorithm, ed25519-sha256, for DKIM. It is a method a signer can use. It is not a statement about which algorithm signed any particular message you received.

Additional means the menu got longer. It does not mean every signer switched, and it does not mean a signer who stayed with an older method on the menu is doing something this note needs to scold. The question for a buyer is narrower. What did this platform use on this message, and did the signature verify? A platform can support a method in a lab and ship mail with a different method, or with no signature at all, when a customer forgets a DNS record.

You do not have to become a cryptographer to ask the question. The signature header carries an algorithm tag. Have the seller show you that tag on a message received at a mailbox you control, not on a diagram. Diagrams are how the word modern replaces the word verified.

• The algorithm tag is read from a received message.
• Verification is stated separately from the algorithm name.
• The signing domain matches the domain you were promised.
• The algorithm is not described as a placement feature.

How do you know which algorithm signed a solo ad?

Read the signature on the live message. The algorithm name is a field on that signature. A vendor slide about modern cryptography is not the field.

Live means a message that went through the same path the buyers will see. A test to yourself, sent from the domain on the order, is enough to start. Open the headers. Find the DKIM signature. Read the algorithm. If there is no signature, the algorithm conversation is over. The mail was not signed. That fact matters more than the menu in the RFC.

If two signatures appear, read both. A message can be signed by the author's domain and again by a forwarder or a mailing list. Each signature has its own algorithm and its own result. A pass on a forwarder's signature does not repair a missing signature from the seller. Write down which domain passed.

Does a newer signature algorithm place the mail in the inbox?

No. A signature supports a claim that the message was not altered after signing, when the signature verifies. Placement is a separate decision by the mailbox provider. Ask the seller not to sell the algorithm as delivery.

Providers care that authentication works, and they care about a pile of other facts, including whether people want the mail. A newer method that verifies is a tidy authentication fact. It is not a substitute for a list that asked. It is not a substitute for a domain you can name. Sellers who bundle the algorithm into a delivery claim are selling a category error. Pay for the send. Check the signature. Keep the inbox sentence out of the invoice.

RFC 8463 lengthened the menu. Your job is to read the order that was served. The algorithm on the message is the algorithm. Everything else is a brochure.