Subject: RE: [ietf-dkim] How to reconcile passive vs active?

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 7 Aug 2006 09:55:50 -0700

> [mailto:[email-masked]] On Behalf Of Dave Crocker

> > 2. I think that the passive/active difference involves a 
> > superset/subset relationship.  That is, I think that the 
> active begins 
> > with the statements made in the passive mode, about the 
> sender/signer, 
> > but extends them to tell the evaluator how to use those statements.

I think that we need strong policy but that there is no place for active statements.

A 'strong policy' in my book is simply a passive statement that when read by the receiver means that it is overwhelmingly likely that the majority of receivers will reject mail without proper authentication.

I don't think that strong policy can be written today, policies will only become strong over time as the Internet email infrastructure adapts to DKIM and the mail filters gain the necessary confidence to implement more restrictive rules.

The barrier to entry for issuing strong policy is pretty high for many. Until most mailing lists are fixed you probably have to implement a separate mail system to allow mailing list mail to bypass the mail filter. I don't think that many people are going to do it without good reason as John suggested earlier.

We could implement the token in mail address scheme I described as a pop extension. User wants to subscribe to a mailing list, they ask their email client to subscribe them, it asks the mail server for a mailing address for the list. The pop server calculates one using a shared secret.

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 7 Aug 2006 10:20:41 -0700

> From: Damon [mailto:[email-masked]] 

> Speaking as a real live, currently employed, sysadmin 
> (numbers bigger than all the scientists in the entire world 
> put together --- just kidding with you Phillip)... "Yikes!"
> Do I need a separate email for when I am living out of a suitcase for
> 6 months at Holiday Inn too? (I know I can use the same one 
> as my mailing list address) Now the guy I emailed is using 
> that address in his address book. Note to self, email him and 
> get him to change it.
> Can we figure something else out that doesn't require me (or 
> my 200k+) users to have to remember two separate addresses, 
> the cases to use each, and remember what the second one is 
> the first time they have to use it in 5 years?

The address in question is simply the address to which the mail is directed, the To address used by the mailing list.

You would have to subscribe under your own name to post to the list.

Aww fishpaste. 

It could be made to work but you would have to do auto-fixup on the outbound mail as well as the inbound. Ugh.