Subject: RE: [ietf-dkim] user level ssp

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 7 Sep 2006 06:53:03 -0700

What is the difference on the recipient side between 'I sign no mail' and 'I sign some mail'?

The recipient will not look at the policy record if there is a valid signature and if there is no signature the fact that it might have been signed is irrelevant.

The only policy that has use to a recipient is to know that every message without exception is signed. Otherwise there is no utility in the policy record.

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Wietse Venema
> Sent: Thursday, September 07, 2006 7:23 AM
> To: [email-masked]
> Subject: Re: [ietf-dkim] user level ssp
> 
> Hallam-Baker, Phillip:
> > I think it is entirely likely that bigbank.com would have a 
> situation 
> > where the mail servers for its east coast offices were adding 
> > signatures but the ones for the west coast were not. The 
> part that is 
> > less easy to see is whether there is value to the short 
> term fix. It 
> > is probably easier to just do the deployment.
> > But it is not certain that this will be the case.
> 
> This hypothetical bank can use the hypothetical "I sign some 
> of my mail" policy until the DKIM roll-out is complete, and 
> then transition to the "I sign all my mail" policy.  
> 
> A per-user mechanism is not the obvious solution for this problem.
> 
> 	Wietse
> _______________________________________________
> NOTE WELL: This list operates according to 
> http://mipassoc.org/dkim/ietf-list-rules.html
> 
> 

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: [email-masked] (Wietse Venema)
Date: Thu, 7 Sep 2006 10:23:58 -0400 (EDT)

Hallam-Baker, Phillip:
> I think it is entirely likely that bigbank.com would have a situation 
> signatures but the ones for the west coast were not. The part that is 
> less easy to see is whether there is value to the short term fix. It 

> mail' and 'I sign some mail'?

I understand that "I sign some of my mail" is equivalent to not
expressing a signing policy at all, and therefore redundant.  I
don't understand the purpose of 'I sign no mail', but I suspect
that it is just as useless as "I sign some".

> The only policy that has use to a recipient is to know that every
> message without exception is signed. Otherwise there is no utility
> in the policy record.

Agreed. 

	Wietse

---

From: <[email-masked]>
Date: Thu, 7 Sep 2006 10:38:50 -0400

I sign no mail==I only sign other peoples mail (third party signer)

I sign some mail==I sign some mail from my domain but don't want to be
sued for you getting unsigned spam purportedly from me.

thanks

Bill Oxley 
Messaging Engineer 
Cox Communications, Inc. 
Alpharetta GA 
[email-masked] 

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Hallam-Baker,
Phillip
Sent: Thursday, September 07, 2006 9:53 AM
To: [email-masked]
Subject: RE: [ietf-dkim] user level ssp

What is the difference on the recipient side between 'I sign no mail'
and 'I sign some mail'?

The recipient will not look at the policy record if there is a valid
signature and if there is no signature the fact that it might have been
signed is irrelevant.

The only policy that has use to a recipient is to know that every
message without exception is signed. Otherwise there is no utility in
the policy record.

---

From: "Thomas A. Fine" <[email-masked]>
Date: Thu, 7 Sep 2006 10:47:52 -0400 (EDT)

>What is the difference on the recipient side between 'I sign no mail'

Well, in terms of receiving and validating email, then such a policy
would mean that if signed mail is received AND the domain is marked as
trusted then no spam filtering is required for that email.  Messages
without signatures can still be accepted, after traditional spam
filtering.

Whereas, "I sign no mail" means that it ALL has to go through a traditional
spam filter.  One could make an argument that such a policy would mean
that any SIGNED mail from this domain can be immediately dropped as
invalid.  In fact, one could even argue that this is the only reason
to have such a policy, as it is the only way it could be different
from a nonexistent policy.

And "I sign all mail" means that unsigned mail can be instantly dropped.
This, from a verification point of view is the ideal situation, and
somewhere down the road, this will essentially be the only policy.

So there is a subtle difference at verification time.  But I fully
agree that I don't expect anyone to use the half-and-half policy,
because it fails to protect the domain or it's reputation.  From the
point of view of a mail forger, there really is no difference, this
domain is still just as ripe for the picking.

          tom

---

From: Dave Crocker <[email-masked]>
Date: Thu, 07 Sep 2006 07:57:48 -0700

> I sign no mail==I only sign other peoples mail (third party signer)

No, it does not mean that.

To the extent that it is, nonetheless, what you want it to mean, what 
problem does it solve?  You sign other peoples' mail.  So what?  How 
does publishing that information solve a demonstrated need?

> sued for you getting unsigned spam purportedly from me.

So, now we are trying to have SSP solve legal problems?  For which 
jurisdictions?

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Michael Thomas <[email-masked]>
Date: Thu, 07 Sep 2006 08:43:15 -0700

>that it is just as useless as "I sign some".
The utility of "I sign some" is not in the policy itself, but in the 
*discovery*
part of the protocol: when you find _any_ valid record, you know that you
can stop looking for one.  Depending on the tree walking aspects of the 
discovery
mechanism, this could be a useful thing. Maybe it would be better to do 
this by not
expressing any  policy/practice in the otherwise valid to get this 
functionality so as
not to confuse the issue with the semantics  of  "I sign some" which 
doesn't seem to
mean much.

I have no idea what use "I sign no mail" has.

       Mike

---

From: <[email-masked]>
Date: Thu, 7 Sep 2006 12:55:34 -0400

1st case I sign no mail, It means that if you receive a signed message
from me I am amenable to you discarding it unread. In the case that I am
a 3rd party signer, the domain setup to do that signing would have a
separate administrative domain for exchanging email about the signing
domain. Example I help administrate cox.net but all emails concerning
that administration go thru cox.com.

2nd case is from offline discussions that revolved about legal
accountability of DKIM.
Thanks,

Bill Oxley 
Messaging Engineer 
Cox Communications, Inc. 
Alpharetta GA 
404-847-6397 
[email-masked] 

-----Original Message-----
From: Dave Crocker [mailto:[email-masked]] 
Sent: Thursday, September 07, 2006 10:58 AM
To: Oxley, Bill (CCI-Atlanta)
Cc: [email-masked]
Subject: Re: [ietf-dkim] user level ssp

-- 

   Dave Crocker

---

From: John Levine <[email-masked]>
Date: 7 Sep 2006 18:11:27 -0000

>Whereas, "I sign no mail" means that it ALL has to go through a
>traditional spam filter.  One could make an argument that such a
>policy would mean that any SIGNED mail from this domain can be
>immediately dropped as invalid.

Nope.  If you get signed mail, that means the domain has published a
signing key.  If the SSP says "I sign no mail", then the domain is
denying the existence of its own signing key.  The only thing we can
conclude is that the person who runs that domain's DNS isn't very good
at it.

>And "I sign all mail" means that unsigned mail can be instantly

Yes, if you believe it.  As has been exhaustively argued here before,
there are lots of plausible ways that a legitimate message could
arrive with a broken or missing signature, with mailing lists being
the horse that has been beaten the hardest.  We also know from SPF
that if you believe -all, you'll lose a lot of valid mail.

One possibility would be to drop all unsigned mail, tough noogies.  Or
you do your whitelisting first to catch the lists and other known
friendly forwarders that sign their mail, and then do SSP after that.
Or something.  These are all paper designs, so nobody has any idea how
much if any of SSP will be useful in practice.

R's,
John

---

From: "Thomas A. Fine" <[email-masked]>
Date: Thu, 7 Sep 2006 15:03:19 -0400 (EDT)

>conclude is that the person who runs that domain's DNS isn't very good

Yeah, I see that now.  I'm willing to retract the first couple of
paragraphs from that email, and I recognize that under the current
model, there's no point in "i sign no mail", as well as no point
to "i sign some mail".

But...

>that if you believe -all, you'll lose a lot of valid mail.

It can't mean anything else.  Sure mail can fail to go through for
a variety of reasons - with or without DKIM.  DKIM isn't designed to
guarantee delivery.  That's not it's job and it's an impossible job.

Once a domain has successfully implemented DKIM though, more of their
mail will get through than in the present case with false-positives
from spam filter software.  In that respect, "I sign all mail" is
an excellent policy if you want to improve your rate of successful
deliveries.

>One possibility would be to drop all unsigned mail, tough noogies.

If their policy is "I sign all mail" then that's the only possible way
to handle this.  I don't care what went wrong or why, they can figure
out what went wrong, and resend the lost messages.  It happens all the
time and we sysadmins know exactly how to deal with it.

It's interesting because we keep finding users that set up software that
uses non-standard software to send out their mail, and then they wonder
why their critical mail delivery fails every time a certain file server
is down for maintainance.  Then we as kindly sysadmins have to point out
that this is the wrong way to send mail and they should have consulted
us first and here's the right way to do it.

The only thing different if we had to institute a "sign all mail" policy
is that it would be much more obvious to the users that most or all of their
mail is not going through, and we would find and fix the problem much more
quickly.

One thing I know - the time I spend fixing or upgrading various mail
senders is vastly less than the time I will waste on configuring spam
filters, and helping users configure spam filters, and dealing with
all the other fallout from spam.

>Or

Without SSP, DKIM is almost completely useless for protecting domains
from being spoofed, and almost completely useless for reducing spam.
With SSP, it will be pretty easy to do both.

	 tom

---

From: Frank Ellermann <[email-masked]>
Date: Thu, 07 Sep 2006 22:32:38 +0200

John Levine wrote:

> We also know from SPF that if you believe -all,
> you'll lose a lot of valid mail.

Hogwash

---

From: John Levine <[email-masked]>
Date: 7 Sep 2006 20:44:19 -0000

>from me I am amenable to you discarding it unread.

If you sign mail and publish signing keys, why is SSP that denies the
existence of your own keys credible?  If I consider the effort to
generate a key pair, and to install one in the DNS and the other in
the MTA, and actually get the MTA to add valid signatures, versus the
effort for some bozo to stick a broken SSP record into the DNS, I know
which one I would believe.

> In the case that I am a 3rd party signer, the domain setup to do
>that signing would have a separate administrative domain for
>exchanging email about the signing domain.

But nobody I know of is planning to look up the SSP of the signatures.
The SSP we're discussing here keys off the sender address in the
message, for some version of sender.

Under what conditions would you expect someone to look up the SSP for
a 3rd party signature domain?  And since you would already have
verified that it's a valid signature, what could SSP tell you that
would be operationally useful?

R's,
John

---

From: "J.D. Falk" <[email-masked]>
Date: Thu, 07 Sep 2006 14:04:07 -0700

>> you'll lose a lot of valid mail.

The blind-faith-in-SPF list is over there.  *points far away*

-- 
J.D. Falk, Anti-Spam Product Manager
Yahoo! Communications Platform Team
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html