Subject: [ietf-dkim] Survey: Reputation string, to use from DKIM

From: Dave Crocker <[email-masked]>
Date: Thu, 16 Aug 2007 15:17:14 -0400

Folks,

I've had a brief exchange, with a few folks recently, that suggests quite a 
bit of ambiguity about the DKIM-related information to be used for assessing 
reputation/accreditation.

      Simply put:

         When you validate a DKIM signature, what information do you
         (intend to) use for querying your reputation/accreditation
         data bases?

So I'd like to ask folks to privately send me their own views on what string 
or strings are intended to be used.

I am asking for private replies only to me so that each response is 
essentially free of influence from others.  I will then summarize the results 
and we can start enjoying a bit of discussion about them.

To be clear:  Of course a site making reputation assessments can and will use 
whatever they wish.  So the issue is not restricting their freedom.

Rather, the question is about DKIM's precise (standardized) semantics.  Note 
that DKIM -base declares that the purpose of DKIM is to "permit a signing 
domain to assert responsibility for a message".

So the purpose of this survey is to ask what string you believe is intended to 
represent that responsibility?

Thanks.

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Dave Crocker <[email-masked]>
Date: Fri, 17 Aug 2007 09:27:33 -0700

Folks,

I appreciate the responses I'm getting.  Unfortunately I was not clear enough 
about what I am asking for.  Most folks seem to be a bit confused.  So let me 
clarify:

      I am looking for you to tell me exactly what DKIM field(s)
      you would use.

      Please cite using a single letter and an equal sign.  That
      is, the parameter value(s) as specified in the DKIM -base
      documentn(RFC 4871).

It's ok if you haven't implemented anything yet.  I'm asking about your 
reading and understanding of the specification document, not your software 
engineering work.

There are no wrong answers.  I am trying to understand the variations of 
interpretations.  I already know the variations are significant. That is what 
prompted my sending out this query.

So the goal is to find out as much as possible about them.  Which fields do 
folks think they should/would use? Do any specific fields dominate the 
community's understanding?

Please note that this does not involve correlating the information with any 
other RFC2822 or RFC2821 fields.  That is a higher-level function that occurs 
beyond the task of basic signature validation.  So your response to the 
current query would be the information that you might feed into this later 
correlation.

The scope of information from which you should draw is strictly about 
DKIM-specific parameters in the DKIM-Signature field of a message and the DKIM 
TXT RR in the DNS.  In other words, what is specified in RFC4871.

Thanks!

d/

ps. If you have already supplied the parameter reference, you do not need to 
do it again.

-- 

   Dave Crocker