• Immutable Page
• Info
• Attachments
• More Actions: Raw Text Print View Render as Docbook Delete Cache ------------------------ Check Spelling Like Pages Local Site Map ------------------------ Rename Page Delete Page ------------------------ Subscribe User ------------------------ Remove Spam Revert to this revision Package Pages Sync Pages ------------------------ Load Save SlideShow

Talk to the product strategist soon after cutting a first draft of this document

DKIMAuthenticatedMail

Mail with a DKIM signature should be trusted similarly to GPG-signed mail. See bug 316272.

As a developer using Launchpad
I want Launchpad to trust mail I send from gmail without needing a separate GPG signature
so that I can send Launchpad commands to control bugs, reviews, etc

Many mail services now send Domain Keys Identified Mail giving reasonably strong authentication that the mail was sent by the domain it claims to have been sent by. This is typically attached without needing any action by the user.

Rationale

Many of our users (50%?) use gmail, fastmail, etc. This would make interaction with Launchpad somewhat easier with them.

It is also useful in a negative direction in that we can reject spam that claims to be from a DKIM-authenticated domain.

This is not urgent -- more like itch-scratching -- but it may be easy.

Stakeholders

• Launchpad users, especially those without GPG integrated into their prefered mail client
• Launchpad/Canonical security specialists (elmo, ...?)
• Launchpad LOSAs?
• Product strategist

Constraints

• When DKIM-signed mail is received by Launchpad, it should be treated as authenticated and be able to contain mp votes, bug commands, etc.
• When invalid DKIM mail is received, it should be rejected. (optional)
• Either way, we should log the sender, message-id, and outcome.
• This should be rolled out in a conservative way that does not risk suddenly rejecting or falsely trusting large amounts of mail. Perhaps we should apply it only for users in a particular group at first.

Subfeatures

• none

Workflows

What are the workflows for this feature? Provide mockups for each workflow.

You do not have to get the mockups and workflows right at this point. In fact, it is better to have several alternatives, delaying deciding on the final set of workflows until the last responsible moment.

Success

How will we know when we are done?

• Sending mail from gmail to new@bugs.l.n creates a new bug (rather than, as at present, complaining that it's not signed.)

How will we measure how well we have done?

• Graph the number of mails received with good or bad dkim signatures
• Blog about this and hope for positive responses

Thoughts?

Put everything else here. Better out than in.