Subject: RE: [ietf-dkim] A more fundamental SSP axiom

From: Arvel Hathcock <[email-masked]>
Date: Fri, 04 Aug 2006 19:10:00 -0500

> Yes but.. I don't think that everyone is going to be aware of the risk
> or ignore it thinking it can't happen to them. 

Quite the contrary really, I'd think.  And anyway, are we to remove from our work even useful things on the basis that there are some who might not understand it?  Surely not.  We should just do our best to document what we can to help them.

-- 
Arvel 

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Damon <[email-masked]>
Date: Fri, 4 Aug 2006 20:31:42 -0400

> Quite the contrary really, I'd think.  And anyway, are we to remove from our work even useful things on the basis that there are some who might not understand it?  Surely not.  We should just do ou…

Nothing contrary about it... I wish I had a nickle for everyone that
set their SPF records with a ~all. I also think that this would be of
diminishing returns. They may set it up this way.. but the first
problem (or second) they have, it will get turned off. Then what is
their alternative? I don't dislike the idea and if it were released
this way... at least I could say I told you so. I am just hoping we
can come up with a solution that will have a safety or 'Plan B'
attached.

Regards,
Damon Sauer

---

From: Douglas Otis <[email-masked]>
Date: Fri, 4 Aug 2006 18:20:54 -0700

On Aug 4, 2006, at 5:31 PM, Damon wrote:

>> > Yes but.. I don't think that everyone is going to be aware of  
>> the risk > or ignore it thinking it can't happen to them.
>>
>> Quite the contrary really, I'd think.  And anyway, are we to  
>> remove from our work even useful things on the basis that there  
>> are some who might not understand it?  Surely not.  We should just  
>> do our best to document what we can to help them.
>
> Nothing contrary about it... I wish I had a nickle for everyone  
> that set their SPF records with a ~all. I also think that this  
> would be of diminishing returns. They may set it up this way.. but  
> the first problem (or second) they have, it will get turned off.  
> Then what is their alternative? I don't dislike the idea and if it  
> were released this way... at least I could say I told you so. I am  
> just hoping we can come up with a solution that will have a safety  
> or 'Plan B' attached.

This Plan B will stop more abuse than you can imagine:

Require that all DKIM clients use a "_dkim.<host-name>" that can be  
verified with a simple Address record lookup.  Define a DKIM client  
policy that can assert "ONLY SEND SIGNED DKIM MESSAGES."  A client  
that does not authenticate or does not sign with DKIM can then be  
blocked.

-Doug

---

From: Damon <[email-masked]>
Date: Fri, 4 Aug 2006 22:01:29 -0400

I really like William and Douglas's ideas...
Is there anyone who doesn't?

Damon

---

From: <[email-masked]>
Date: Fri, 4 Aug 2006 22:12:19 -0400

Not before Doug defines client a little more clearly :-)

Bill Oxley 
Messaging Engineer 
Cox Communications, Inc. 
Alpharetta GA 
404-847-6397 
[email-masked] 

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Damon
Sent: Friday, August 04, 2006 10:01 PM
To: Douglas Otis
Cc: [email-masked]
Subject: Re: [ietf-dkim] A more fundamental SSP axiom

Damon