Subject: Re: [ietf-dkim] Delegated signatures in real life

From: Scott Kitterman <[email-masked]>
Date: Wed, 30 Aug 2006 7:46 -0400

On Wed, 30 Aug 2006 00:38:30 +0100 Stephen Farrell 
<[email-masked]> wrote:  

>Does anyone have a real example of such an outfit and their specific
>requirements? Not doubting they exist, but it'd be nice to see as
>realistic an example as John posted.

I think it's difficult to respond to this the way John did.  I think my 
last note to him about providers not supporting NS delegation is a partial 
answer to your question.

In addition, I would also note that it is extremely easy in a group like 
this to lose track of how non-technical many domain owners are today.  I've 
helped several hundred people with getting SPF records published and with 
SPF related e-mail issues over the last two years (JFTR, only a handful 
were related to the forwarding 'problem' so feared in more technical 
circles) and so I think I have a reasonable experience base to understand 
this class of user.

Starting from my sending a message that says something like:

'You need to publish a TXT record in you public DNS for example.com that 
says 'foo'.  You will need to ask your DNS provider how to do this with 
their system or to do that for you."

The most common follow-up questions I get are:

"Who's that?"
"My provider says they don't support that.  What do I do now?"
"What is DNS?"
"How do I do that" - these run their own, but can't figure it out.

Because of the first one, I now just figure it out with Dig and tell them 
assuming they won't know.  No one has ever complained about this.

The second one led to me maintaining http://www.kitterman.com/spf/txt.html.

The third one is (with one exception that was Mac OS 9) always windows DNS 
so I have a canned response.

That's exemplary of what we are up against in the user base for small 
domains.

HTH,

Scott K
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "Hector Santos" <[email-masked]>
Date: Wed, 30 Aug 2006 09:39:18 -0400

----- Original Message -----
From: "Scott Kitterman" <[email-masked]>
To: "DKIM List" <[email-masked]>

>> Does anyone have a real example of such an outfit and their
>> specific requirements? Not doubting they exist, but it'd be
>> nice to see as realistic an example as John posted.
>
> I think it's difficult to respond to this the way John did.  I
> think my last note to him about providers not supporting NS
> delegation is a partial answer to your question.

Its not difficult to show.  But it was difficult to understand what was the
point behind the question.  That there exist companies outsource their
services vs companies that do not?  There are millions of domains who do not
use NS to share their services.  So I fail to understand the point.

If you view it as a 3rd party concept, the problem is that it was not in the
eyes of the verifier (2822.From, d= were the same).  The only person that
said it was 3rd party was the human.

Too me, it was a great example about the lack of trust one will have with
such mail coming their way - a spammer hiding behind others signing for
them. An open DKIM relay!   Which is exactly what most of us (the world,
maybe not this WG) are trying to stop - the 3rd party masquerades!

--
Hector Santos, Santronics Software, Inc.
http://www.santronics.com

---

From: John Levine <[email-masked]>
Date: 30 Aug 2006 14:28:29 -0000

>this to lose track of how non-technical many domain owners are today. 

Right, and that means that they use someone else to provide their
mail service.

Keep in mind that DKIM, unlike SPF, requires the active participation
of whoever runs your outgoing mail server to apply signatures, unless
you are enough of a weenie to run a signing engine in your MUA and do
your own key management.  For the vast majority of non-technical
users, their ISP or hosting company's MTA will apply its own
signature, and that will be good enough.  Indeed, it will probably be
better than a tiny domain's own signature, since whatever formal or
informal reputation systems recipients use are much more likely to
have entries for the ISP than for a tiny domain that sends 12 messages
a week.

I suppose it is hypothetically possible that providers will upgrade
their MTAs to support per-domain DKIM signing and out of perverse
hostility won't offer the DNS support for it.  That has never
impressed me as a scenario likely enough to be worth inventing a new
mechanism with unknown security problems that has to be implemented by
all DKIM recipients.

R's,
John

---

From: "Hector Santos" <[email-masked]>
Date: Wed, 30 Aug 2006 10:50:06 -0400

----- Original Message -----
From: "John Levine" <[email-masked]>
To: <[email-masked]>
Cc: <[email-masked]>
Sent: Wednesday, August 30, 2006 10:28 AM
Subject: Re: [ietf-dkim] Delegated signatures in real life

> Keep in mind that DKIM, unlike SPF, requires the active
> participation of whoever runs your outgoing mail server
> to apply signatures, unless you are enough of a weenie
> to run a signing engine in your MUA and do your own key
> management.

Exactly, so unless you have a written, verbal contract, TOS or what have
you, signing mail on the behalf of the 1st party, masquarading as the 1st
party or as the 3rd party has some serious implications.

Unless there is some prior agreement or authorization, you're opening up a
can of worms.

And what if the MUA weenie is signing mail?  How is his or her ISP going to
handle that?  Just blindly resign mail again?  Why?  For what purpose?

---

From: "J.D. Falk" <[email-masked]>
Date: Wed, 30 Aug 2006 14:58:03 -0700

> mechanism with unknown security problems that has to be implemented by

+1

> handle that?  Just blindly resign mail again?  Why?  For what purpose?

That's between the MUA weenie and their ISP, and is a great example of 
one of the cans of worms that may be opened if the protocol tries to get 
in the way of such agreements.

On 2006-08-30 13:32, Scott Kitterman wrote:

> It's not a matter of money, but a matter of the complexity of dealing with 
> an audience that the first step in the process is you have to explain what 
> a DNS service IS and they have very limited time or interest in 
> understanding.

An entire industry already exists, ready to serve them.  If individual 
companies within that industry fail to offer a complete end-to-end 
service...well, that's not DKIM's fault.

-- 
J.D. Falk, Anti-Spam Product Manager
Yahoo! Communications Platform Team
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html