A list that rewrites the solo ad has to sign it again

Answer A list or platform that rewrites a solo ad breaks the original DKIM signature unless it signs the copy it sends. RFC 6377, published in May 2011, is the note that describes the clash between DKIM and mailing lists. Ask who signs the version the subscribers actually receive.

The note that started this: RFC 6377, DomainKeys Identified Mail (DKIM) and Mailing Lists, RFC 6377, May 2011.

August 14 covered the chain a forwarder can seal. Today's document is older and more direct. Lists edit mail. Editing mail breaks a signature that covered the body. The fix the specification points at is simple to say and easy to skip. The list signs the outgoing copy with its own domain. A solo ad platform is a list that edits for a living. Click wrappers are edits. Footers are edits. A from-name the buyer insisted on is an edit.

RFC 6377 is DKIM and mailing lists. It is not a 2026 product update. It is the explanation you hand someone who believes a signature applied in a draft still describes the message after the tracking tool ran. The original signer covered a set of fields. The list added a subject tag, a footer, a new link. The hash no longer matches. Receivers that require the signature to survive will fail the old one. The list's own signature is what can still pass, if the list applied one, and if that signature's domain is the domain you were willing to stand under.

What does RFC 6377 say happens when a list rewrites a message?

A mailing list that changes the message breaks the original DKIM signature. RFC 6377, from May 2011, describes that clash. The list is supposed to sign the copy it distributes.

The list has a reason to edit. It adds the unsubscribe instruction, it identifies itself, it keeps its own records. Those are legitimate list behaviors. They are also modifications. DKIM does not grant an exception because the edit was helpful. The receiver either sees a valid signature over the bytes it received, or it does not. A helpful footer with no new signature is a broken check wearing a good intention.

On a solo ad, the editor is often the seller's platform rather than a discussion list from 2011. The principle does not care about the product name. If you buy solo ads, assume the tool will rewrite the links, because the seller wants the click count. Then require the signature on the rewritten message. The draft you approved in a document is not the bytes that were hashed.

• The seller admits which parts of the message their tool rewrites.
• The outgoing signature is applied after those rewrites.
• The d= domain of that signature is in the quote.
• A pre-tracking signature is not offered as proof.

Does the original signature survive a solo ad platform's click tracking?

Not if the platform rewrites links, adds a footer, or changes the from-address. The signature that matters is the one on the rewritten copy. Ask for that d= domain.

Some tools are careful and sign at the last step. Some tools sign early and then decorate. You cannot tell from the sales page. You can tell from a header on a message that went through the same path as the drop. Seed that path. Read d=. If the domain is the platform's shared signer, you already know the alignment question from earlier in the month. If there is no surviving signature, the rewrite ate the check and nobody replaced it.

If you sell the send, sign last. Make the last step in the pipeline the signature, after the footer and after the click wrapper. Then the header you show the buyer matches the mail the list received. Anything else is a demo of a message you did not send.

What should you ask the seller to show?

Show a live header from the message subscribers received, including the signature that survived their own edits. A signature from the draft, before tracking was applied, is a signature of a message nobody got.

Ask for it on the seed address you control, the same day, the same tool settings as the drop. A header from a different tool is a different product. A PDF of a tutorial is not a header.

Put the signer next to the price. Safe solo ads sellers can produce that header without a speech. RFC 6377 is fifteen years old. The clash it describes is still how a rewritten solo ad loses the signature the buyer thought they were buying.