Re: [Asrg] Re: bounces, and anit-spam principles

[Douglas Otis <dotis at mail-abuse.org>]

On Mon, 2007-01-22 at 18:09 -0800, Steve Atkins wrote:
> On Jan 22, 2007, at 5:59 PM, Dan Oetting wrote:
> > On Jan 22, 2007, at 5:48 PM, Steve Atkins wrote:
> >
> >> Identifying the sender reliably is the missing link in the current  
> >> system.
> >
> > The missing link is really 2 different problems depending on which  
> > side of the link you are on. The receiver can't identify the actual  
> > sender and the smarthost can't reliably identify the email as  
> > abusive. Providing direct feedback when email is abusive (such as  
> > when unsolicited email hits a spamtrap) could bridge the gap and  
> > permit the smarthost to take appropriate action to stop the abuse.
> 
> DKIM and ARF between them provide all the protocol-level solution  
> needed for that. DKIM was the missing link I was thinking of.

Problems remain even when DKIM provides a verifiable domain playing some
role in sending the message.  DKIM excludes the envelope.  A message
signed by Yahoo! can be replayed.  It remains to be seen how effective
ARF might be at suppressing abuse of a free account.  Looking at the
situation with .com, it seems even charging for a service might not
offer much of a reduction, due to a high level of fraud.

DKIM limitations on indicating on who's behalf the message is signed
seems aimed at providing a method to extort use of private keys of
customers as a means to avoid receiving the ARF information directly.
This does not bode well for DKIM and ARF working together. : (

Perhaps something as simple as an 'mx-' prefix on the SMTP client
hostname could be used to indicate compliance with address validation,
in addition to a convention where the domain below this label also
accepts ARF reports.  The prefix also implies the domain's authorization
for sending email.

-Doug


_______________________________________________
Asrg mailing list
Asrg at ietf.org
https://www1.ietf.org/mailman/listinfo/asrg