Subject: Re: [ietf-dkim] How to reconcile passive vs active?

From: Damon <[email-masked]>
Date: Mon, 7 Aug 2006 16:31:00 -0400

On 8/7/06, Hallam-Baker, Phillip <[email-masked]> wrote:
> > [mailto:[email-masked]] On Behalf Of Damon
>
> > Here is the scenario:
> >
> > My CEO calls me and says, "I sent an email to the SEC and
> > they never got it!"
> > - I tell him to hang on whilst I check the logs (and I finish
> > my bagel) ... "We are showing a successful delivery. I will
> > get hold of the postmaster at the SEC an figure it out."
> > So I spend half a day trying to get the right schmuck on the
> > phone and another half a day trying to convey the urgency.
>
> OK so sounds to me like what you are saying is that to turn on strong policy rejection you need to also turn on some sort of reporting mechanism when exceptions occur.

In this scenario, I don't know an exception occured. Only the receiver does.
(Note: I don't know the postmaster at the SEC but I am sure that
he/she is not a schmuck)

>
> The scenario you describe here is premised on the idea that it's a one strike policy and that being incorrectly identified as spam is not a problem.
>
I don't know what their policy will be. All I know is that I told them
via my policy that I sign all mail.

>
> This type of problem is inevitable at some level without feedback regardless of whether you have policy or not.
>
> 'I sign all' is not the same as 'Reject without a signature'.
>
This is my sticking point to "I sign all"- If it is bad, and you are
going to let it pass anyway, why have it? For those like eBay and
others, I think they would implement this in the hope that the
receiver would reject it.

> 'I sign all' plus 'I am a bank targetted by phishing' may well be a good reason for Comcast to decide that no signature means reject. That would not be a good policy for the SEC or the FDIC.

I am hoping that if we had to turn in our homework tomorrow, something
that defines this would be in the language describing "I sign all"

> The sender says what they do and what they are. The receiver decides how to interpret that information. It must be very clear (a MUST) that I sign all is not the same as instructing the receiver to do an automatic reject. That is why I don't want to see anything that smacks of telling the receiver what to do.
>
Considering the people that would benefit from this the most would
most likely want the receiver to bit bucket the message... how would
you word this?

Regards,
Damon Sauer
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 7 Aug 2006 13:15:53 -0700

The scenario you describe here is premised on the idea that it’s a one strike policy and that being incorrectly identified as spam is not a problem.

---

From: Frank Ellermann <[email-masked]>
Date: Tue, 08 Aug 2006 16:42:14 +0200

Hallam-Baker, Phillip wrote:

> The receiver decides how to interpret that information. It
> must be very clear (a MUST) that I sign all is not the same
> as instructing the receiver to do an automatic reject. That
> is why I don't want to see anything that smacks of telling
> the receiver what to do.

This message apparently contradicts itself.  There's no such
"MUST" in "I sign all", and it's perfectly okay if receivers
decide to reject unsigned "I sign all" mails.  If they decide
to accept it anyway it's most likely silently dropped later,
or bounced to innocent bystanders (1), and that would be bad.

Frank

(1): minus sound cases of bounces over SPF PASS Return-Paths.

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 08 Aug 2006 15:55:43 +0100

Folks,

This has been discussed already. Are we going to benefit
from yet another round? Let's wait for reqs-00 and discuss
how it phrases things,

Thanks,
Stephen.