Subject: RE: [ietf-dkim] Delegation semantics

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 29 Aug 2006 11:02:21 -0700

This is rather different, in fact it is essentially being done for the same purpose the example I gave.

The point I was trying to make here is that if I delegate any part of my DKIM key record space to your system you now have the ability to produce email messages that authenticate as coming from me.

Regardless of any statement that might appear in the DKIM spec I can't see my CISO accepting a situation where I delegate to a third party the ability to sign on behalf of my CEO. You can claim that the signature is not transactional as much as you like, I don't think such a statement would be supportable.

We could continue to go the NS record route but why tell people to use a mechanism that has serious security problems, does not expose the desired information, does not provide as much control, is vastly more complex and requires use of very powerful DNS constructs?

I think that the presumption here should be against use of mechanisms like NS or CNAME if the use case is adopted unless it can be shown that there is no other way to achieve the outcome.

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of 
> [email-masked]
> Sent: Tuesday, August 29, 2006 12:46 PM
> To: [email-masked]
> Subject: RE: [ietf-dkim] Delegation semantics
> 
> http://www.mxlogic.com/emaildefense/comprehensive_protection.h
> tml?GCID=S
> 16104x002&KEYWORD=mx%20logic
> these folks make a living by using delegated namespace.
> Thanks,
> 
> Bill Oxley
> Messaging Engineer
> Cox Communications, Inc. 
> Alpharetta GA
> 404-847-6397
> [email-masked] 
> 
> 
> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]] On Behalf Of John Levine
> Sent: Tuesday, August 29, 2006 12:30 PM
> To: [email-masked]
> Subject: Re: [ietf-dkim] Delegation semantics
> 
> >I think that the NS suggestion is a bad one for policy reasons. I am 
> >never going to delegate any part of my DNS. Space to a third 
> party and 
> >I don't think anyone else is likely to either.
> 
> Mailers routinely delegate subdomains to their ESPs right now.  For
> example:
> 
> $ dig email.orbitz.com ns
> 
> ; <<>> DiG 9.3.1 <<>> email.orbitz.com ns ;; global options:  
> printcmd ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49736 ;; 
> flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0
> 
> ;; QUESTION SECTION:
> ;email.orbitz.com.              IN      NS
> 
> ;; ANSWER SECTION:
> email.orbitz.com.       16536   IN      NS
> bb1dns1.edc.dartmail.net.
> email.orbitz.com.       16536   IN      NS
> bb1dns2.ddc.dartmail.net.
> email.orbitz.com.       16536   IN      NS
> bb1dns3.ddc.dartmail.net.
> email.orbitz.com.       16536   IN      NS
> bb1dns1.ddc.dartmail.net.
> 
> R's,
> John
> _______________________________________________
> NOTE WELL: This list operates according to 
> http://mipassoc.org/dkim/ietf-list-rules.html
> 
> _______________________________________________
> NOTE WELL: This list operates according to 
> http://mipassoc.org/dkim/ietf-list-rules.html
> 
> 

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Douglas Otis <[email-masked]>
Date: Tue, 29 Aug 2006 11:09:08 -0700

On Aug 29, 2006, at 11:02 AM, Hallam-Baker, Phillip wrote:

> The point I was trying to make here is that if I delegate any part  
> of my DKIM key record space to your system you now have the ability  
> to produce email messages that authenticate as coming from me.
>
> Regardless of any statement that might appear in the DKIM spec I  
> can't see my CISO accepting a situation where I delegate to a third  
> party the ability to sign on behalf of my CEO. You can claim that  
> the signature is not transactional as much as you like, I don't  
> think such a statement would be supportable.
>
> We could continue to go the NS record route but why tell people to  
> use a mechanism that has serious security problems, does not expose  
> the desired information, does not provide as much control, is  
> vastly more complex and requires use of very powerful DNS constructs?
>
> I think that the presumption here should be against use of  
> mechanisms like NS or CNAME if the use case is adopted unless it  
> can be shown that there is no other way to achieve the outcome.

Agreed.

-Doug

---

From: John Levine <[email-masked]>
Date: 29 Aug 2006 22:05:48 -0000

>The point I was trying to make here is that if I delegate any part of
>my DKIM key record space to your system you now have the ability to
>produce email messages that authenticate as coming from me.

Right.  That's what an ESP does, send mail on behalf of its clients.
ESPs already sign mail with DK signatures in the customer's domain,
using delegated subdomains like the one I showed in my last message.
I can dig up some examples if people don't believe it.

Perhaps I'm missing something, but an argument that argues that ESPs
do not exist doesn't strike me as very persuasive.

R's,
John

---

From: "J.D. Falk" <[email-masked]>
Date: Tue, 29 Aug 2006 16:16:06 -0700

> I can dig up some examples if people don't believe it.

At that point it's a contractual issue, not a standards issue.  They'll 
jump through whatever technical or political hurdles are necessary to 
fulfill that contract.

> do not exist doesn't strike me as very persuasive.

Especially given that ESPs appear (in general) more receptive to 
adopting DKIM ASAP than any other category of sender.

-- 
J.D. Falk, Anti-Spam Product Manager
Yahoo! Communications Platform Team
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html