Subject: Re: accept, deny, or other delivery decisions (was Re: [ietf-dkim] SSP= FAILURE DETECTION)

From: Scott Kitterman <[email-masked]>
Date: Tue, 12 Sep 2006 0:07 -0400

On Mon, 11 Sep 2006 20:36:52 -0700 Steve Atkins <[email-masked]> wrote:

>So describing "inconsistent results" as a "risk of signing" seems
>something of a non-sequitur. Or possibly I'm misunderstanding,
>in which case I'm sure Hector will expand on the issue, with a
>clearer explanation of what he means and some concrete
>examples.

If I understand Hector's point, and I'm sure he'll correct me if I don't, I 
agree with him, although I wouldn't put it as strongly as he does.

Today the primary identity for reputation is the client IP address.  For 
better or for worse, we all pretty much understand how it works and how to, 
reasonably well, stay off the bad lists.  Once you start to sign, that 
changes.  Reputation can, and should, have a name basis.

Now I don't say thing are better or worse, just different and less certain. 
 In terms I'm used to, uncertainty ~= risk.  Is the risk large or small?  I 
have no data (FWIW I've decided to start DK signing some of my mail to get 
some experience with it).

Why do senders want to accept this risk?

I think that in the long run, this will work out and it will be understood 
at least as well as the IP based systems are now, but there is a period of 
initial uncertainty.

Scott K
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Jeff Macdonald <[email-masked]>
Date: Wed, 13 Sep 2006 08:48:58 -0400

> Why do senders want to accept this risk?

Because they don't have a choice. At least ESPs don't. When Microsoft
said:

'If you do Sender-ID, you have a better chance of the message going
into the Inbox'.

'If you do Sender Score Certified (or whatever Bonded Sender is called
now), you have a better chance of the message going into the Inbox'.

Not to mention that their support desk uses both of these as excuses
when mail is either missing or in the bulk folder.

Even when a client has both of these, blocks/'missing mail'/'bulk folder
placement' still happen.

Currently system don't seem to take past reputation into consideration.
For instance, a customer could have a great reputation for months or
years, then one day, some one goofs (either the sender or the receiver)
and a block or placement into the bulk folder happens.

-- 
:: Jeff Macdonald | Principal Engineer, Messaging Technologies
:: e-Dialog | [email-masked]
:: 131 Hartwell Ave. | Lexington, MA 02421 
:: v: 781-372-1922 | f: 781-863-8118 
:: www.e-dialog.com

---

From: Douglas Otis <[email-masked]>
Date: Wed, 13 Sep 2006 08:15:20 -0700

On Wed, 2006-09-13 at 08:48 -0400, Jeff Macdonald wrote:
>
> Even when a client has both of these, blocks/'missing mail'/'bulk
> folder placement' still happen.
> 
> Currently system don't seem to take past reputation into
> consideration. For instance, a customer could have a great reputation
> for months or years, then one day, some one goofs (either the sender
> or the receiver) and a block or placement into the bulk folder
> happens.

Are you saying that by signing the message someone may decide to block
your messages, whereas without signing they won't?

It is not easy to assess DKIM related behavior simply because the
envelope is not included within the signature.  Signed messages sent to
the wrong entity could be sent by anyone, including your competitor.

Even a desired domain like Yahoo! will sign spammy messages that can be
resent from elsewhere.  Once anyone decides the DKIM signature can be
used to control spam, will quickly discover it will not work either as a
sole basis for acceptance or rejection.

DKIM might be used to allow bulk-senders to bypass filters that might
otherwise trip based upon their volume of identical messages.  DKIM will
clearly identify an initial source of a spammy message for reporting
purposes.  DKIM use in conjunction with retained email-addresses can
also provide excellent anti-spoofing protections.

As a result DKIM should:
 - Improve the open rates of valid messages.
 - Reduce the success rates of criminal fraud.
 - Improve the accurate performance of message filters.
 - Not modify a signer's reputation based upon wrong recipients.(goofs)

Due to liabilities when using a DKIM as a basis for name based
reputations, such will likely be limited to identifying clearly criminal
behaviors, not goof rates.

-Doug