Subject: [ietf-dkim] Delegated signatures in real life

From: John L <[email-masked]>
Date: Tue, 29 Aug 2006 18:17:51 -0400 (EDT)

Here's the headers from a message that Doubleclick just sent to my Yahoo 
account on behalf of Orbitz.  Note that the From: address and DK signature 
are in email.orbitz.com, even though it was sent by Doubleclick from a 
Doubleclick IP.  Yahoo thoughfully displayed a little now saying that the 
DK signature was good when I looked at the message.  I also include the 
key record, retrieved from Doubleclick's name servers.

Senders already use NS delegation to let third parties put on first party 
DK signatures.  It works.  It's popular.  There is no need to invent 
another way to solve this solved problem.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://www.johnlevine.com, Mayor
"More Wiener schnitzel, please", said Tom, revealingly.

Date: Tue, 29 Aug 2006 10:40:32 -0400 (EDT)
From: "Orbitz"<[email-masked]>
To: [email-masked]
Subject: Joe, Sale Ending & Rochester Flights from $142 r/t
Content-Length: 6278

(look for the key record)

$ dig dk._domainkey.email.orbitz.com txt

; <<>> DiG 9.3.1 <<>> dk._domainkey.email.orbitz.com txt
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23293
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;dk._domainkey.email.orbitz.com.        IN      TXT

;; ANSWER SECTION:
dk._domainkey.email.orbitz.com. 21600 IN TXT    "p=MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhALdLXrYpY2RRUPHr6ph9jVnrFAYvyNjEgGVRmxjiu2EUBEyQDKFOSiDzS00xN/HaIt5IknLJumgu/YdaHhHAgsnnORUV1JwDcOZ3Xo3Iz9cT3ojg4us6SpQhl01dVGS6dwIDAQAB\;"

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Douglas Otis <[email-masked]>
Date: Tue, 29 Aug 2006 16:23:20 -0700

On Aug 29, 2006, at 3:17 PM, John L wrote:

> Senders already use NS delegation to let third parties put on first  
> party DK signatures.  It works.  It's popular.  There is no need to  
> invent another way to solve this solved problem.

In these cases a technical and legal staff laid a foundation for this  
type of solution.  For large outfits with enough on the table, this  
is fine.  However, there are many smaller outfits that could benefit  
from a solution less reliant upon intricate and coordinated efforts  
and underpinnings.  Associations can be established by the signature  
and a simple policy referenced from the originator naming the  
signer.  This would establish a practical system offering slightly  
different annotations, but one that would better protect Eliot's dad.

-Doug

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 30 Aug 2006 00:38:30 +0100

Douglas Otis wrote:
> type of solution.  For large outfits with enough on the table, this is 
> fine.  However, there are many smaller outfits that could benefit from a 
> solution less reliant upon intricate and coordinated efforts and 
> underpinnings.  

Does anyone have a real example of such an outfit and their specific
requirements? Not doubting they exist, but it'd be nice to see as
realistic an example as John posted.

S.