Subject: RE: [ietf-dkim] Issue 1365: drop "never send mail"?

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 27 Feb 2007 14:28:21 -0800

I thought we would be dropping this as out of scope, not redundant.

What mechanism is there for 'never send mail today'? 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Eric Allman
> Sent: Tuesday, February 27, 2007 5:21 PM
> To: IETF DKIM WG
> Subject: [ietf-dkim] Issue 1365: drop "never send mail"?
> 
> <https://rt.psg.com/Ticket/Display.html?id=1365>
> 
> Issue 1365 (Subject: SSP: typos) includes this brief comment from
> Frank:
> 
> > 5.3 (2): IIRC we've identified "never send mail" as a 
> special case of 
> > "strict", and then just not sending mail, let alone signing it. IMO 
> > you can delete this point.
> 
> Based on the notes we seem the WG seems to be favoring 
> dropping the "never send mail" indication because it's 
> redundant, but we never seem to have gotten final consensus.
> 
> It makes sense to me.  Does anyone want to argue that it 
> needs to stay?  (Foolish me, I meant to say "Who wants to argue...".)
> 
> eric
> 
> _______________________________________________
> NOTE WELL: This list operates according to 
> http://mipassoc.org/dkim/ietf-list-rules.html
> 

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Jon Callas <[email-masked]>
Date: Tue, 27 Feb 2007 14:33:09 -0800

> What mechanism is there for 'never send mail today'?

You can say that you never send mail from a domain with SPF.

	Jon

---

From: Michael Thomas <[email-masked]>
Date: Tue, 27 Feb 2007 15:18:39 -0800

> I thought we would be dropping this as out of scope, not redundant.

I agree: the semantics of "I send no mail" and "I sign everything"
and then send no mail are not the same. The former is a much stronger
statement.

		Mike

---

From: Graham Murray <[email-masked]>
Date: Wed, 28 Feb 2007 07:51:17 +0000

> You can say that you never send mail from a domain with SPF.

SPF operates on the RFC2181 envelope, so with SPF you can state that a
domain will never legitimately appear in the SMTP MAIL FROM: (or
EHLO). It offers no mechanism to say that the domain will not be used
in any RFC2822 From:, Sender:, Resent-From: etc
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 28 Feb 2007 09:42:27 +0000

> in any RFC2822 From:, Sender:, Resent-From: etc

Ah. I didn't know that - thanks.

But even if SPF doesn't provide the exact thing that 1365 requests,
we still have to address whether or not this feature is in-scope for
DKIM (which is different from wanting it done somewhere).

Stephen.

---

From: Graham Murray <[email-masked]>
Date: Wed, 28 Feb 2007 11:59:14 +0000

Graham Murray <[email-masked]> writes:

> SPF operates on the RFC2181 envelope,

That should, of course, be RFC2821. I do not know what I must have
been thinking when I wrote that :)
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Hector Santos <[email-masked]>
Date: Wed, 28 Feb 2007 08:50:33 -0500

> in any RFC2822 From:, Sender:, Resent-From: etc

FWIW, the SPF variant called SENDER-ID (A.K.A SPF 2?) does operate on 
the RFC-2822 entities as well.

--
HLS

---

From: Frank Ellermann <[email-masked]>
Date: Wed, 28 Feb 2007 16:54:12 +0100

> That should, of course, be RFC2821. I do not know 
> what I must have been thinking when I wrote that :)

For some time SPF drafts had a normative reference
to RFC 2181 chapter 6 (Zone Cuts).  Until Paul Vixie
convinved us that it really doesn't work in practice,
or at least not as easy as RFC 2181 suggests (with a
nslookup -query=ns ;-)

Frank

---

From: Arvel Hathcock <[email-masked]>
Date: Wed, 28 Feb 2007 19:30:06 -0600

> What mechanism is there for 'never send mail today'?

Sender ID and NULL MX (draft-delany-nullmx-00.txt)

Arvel

---

From: <[email-masked]>
Date: Wed, 28 Feb 2007 20:38:56 -0500

Well I have no intention of ever letting Sender ID in the door and
nullMX is just another dns entry to maintain. I already have DKIM and
SSP I should be able to use either as a method to warn people that I
don't originate mail, I either sign or forward.
thanks

Bill Oxley
Messaging Engineer
Cox Communications
404-847-6397

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Arvel Hathcock
Sent: Wednesday, February 28, 2007 8:30 PM
To: [email-masked]
Subject: Re: [ietf-dkim] Issue 1365: drop "never send mail"?

Arvel

---

From: Douglas Otis <[email-masked]>
Date: Wed, 28 Feb 2007 18:07:07 -0800

> Sender ID and NULL MX (draft-delany-nullmx-00.txt)

Ignoring the DDoS problem inherent with Sender-ID, Sender-ID  
identifies the IP address used by an SMTP client used in conjunction  
with a PRA.  Unless version 2 of this record is used, which is almost  
never the case, this record only declares the that email-address  
domain should not be used in the MailFrom header, not that this  
domain never sends email.

The MX record pointing to root means the domain never accepts email.   
It also means this domains does not care about root servers.  : (

There is a chance DKIM may create unwanted traffic, where it would be  
good to have a record that say's "don't ask me about DKIM".  Even if  
the domain owner does not use DKIM, such a record could be used in  
conjunction with accreditation services likely to spring into  
existence due to DKIM.  Before even processing the signature, it  
seems wise to check an accreditation service first.  With the "Don't  
Ask" assertion, any DKIM signature can be immediately rejected  
without bothering the victim of the spoof.

-Doug