Subject: RE: [ietf-dkim] Can vendor's really say they have DKIM support yet?

From: <[email-masked]>
Date: Wed, 1 Feb 2006 15:33:18 -0500

Without a policy statement DKIM asserts that the sending MTA sent this
particular signed message. That is a benefit of itself to clearly
identify the sending party. A policy statement that is

1 I sometimes sign
2 I don't care who signs this
3 I always sign and don't want anyone else to sign

Is interesting to some, but unless the policy is number 3 is less that
useful to others  

Bill Oxley 
Messaging Engineer 
Cox Communications, Inc. 
Alpharetta GA 
404-847-6397 
[email-masked] 

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Hector Santos
Sent: Wednesday, February 01, 2006 2:57 PM
To: Jeff Macdonald
Cc: [email-masked]
Subject: Re: [ietf-dkim] Can vendor's really say they have DKIM support
yet?

----- Original Message -----
From: "Jeff Macdonald" <[email-masked]>
To: <[email-masked]>

> Dave,
> Thanks for the response. So just implementing
> http://mipassoc.org/dkim/specs/draft-allman-dkim-base-00-10dc.txt
> without SSP is considered a valid DKIM implementation?

For the list IETF record, If true, I believe quite strongly, with the
hat of a senior software engineer, find this highly irregular premature
promotion of an unsafe non-standard.

If Steve Atkins assertion is true and early adopters will be bulk
mailers and distributors,  just consider the impact that it will impose
of SMTP receivers who will undoubtedly find issues with guaranteed to
occur mix policy exploits with no SSP verification protection.  Systems
will take matters into their own hands, ignore it or use DKIM signed
mail against the bulk mailers thus reducing DKIM to yet another wasted
bandwidth contribution to the net.  Worst, advanced derivatives that
secure DKIM protocol will surely emerge.

In my opinion, any good actor member of the bulk mail community or DMA
will be risking their reputation and mail distribution operations with a
DKIM only concept.

--
Hector Santos, Santronics Software, Inc.
http://www.santronics.com

_______________________________________________
ietf-dkim mailing list
http://dkim.org

_______________________________________________
ietf-dkim mailing list
http://dkim.org

---

From: Dave Crocker <[email-masked]>
Date: Wed, 01 Feb 2006 13:07:15 -0800

Folks,

> particular signed message. 

Hence DKIM provides a stable, validated identifier that declares its 
"responsibility" for the message.

Having such a validated identifier permits various reputation and accountability 
work, even without the benefits of signer-related policy publication.

 > Implementing an Internet-Draft is not implementing a standard.
 > For the latter, the RFC has to exist.
 >
 > If you choose to write code based on an Internet-Draft you are
 > taking a risk that the specification changes before it becomes
 > a standard.

The core DKIM spec was reasonably stable prior to submission to the IETF.  How 
much change the IETF chooses to impose, and how much of that change will make 
prior implementations incompatible, is yet to be determined.

Such a determination is typically a matter of working group consensus.  Those 
caring about retaining compatibility will voice that desire strongly and 
repeatedly, whenever compatibility is threatened..

That said, there already are implementations, as noted on the DKIM web page.  To 
my knowledge, they are using the same version of the specification.  The test of 
interoperability is interoperability, not the publication status of the 
specification that is used.

d/
-- 

Dave Crocker
Brandenburg InternetWorking
<http://bbiw.net>
_______________________________________________
ietf-dkim mailing list
http://dkim.org