Subject: Re: [ietf-dkim] On the Selector

From: Franck Martin <[email-masked]>
Date: Tue, 26 May 2009 12:48:06 +1200 (NZST)

see 

http://feedbackloop.yahoo.net/ 
http://www.gettingemaildelivered.com/yahoo-feedback-loop-released-to-the-public 

----- Original Message ----- 
From: "Steve Atkins" <[email-masked]> 
To: [email-masked] 
Sent: Tuesday, 26 May, 2009 10:46:15 AM GMT +12:00 New Zealand 
Subject: Re: [ietf-dkim] On the Selector 

On May 25, 2009, at 12:42 PM, Franck Martin wrote: 

> Hi, 
> 
> I see some ESP are using the selector to do domain reputation. 

In what way? Given that the selector is an opaque string, are you 
reading something into their choice of selectors that isn't there, or 
are they documenting that they intend meaning for their selectors? 

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Steve Atkins <[email-masked]>
Date: Mon, 25 May 2009 19:14:35 -0700

> http://www.gettingemaildelivered.com/yahoo-feedback-loop-released-to-the-public

Yup, that's connected to the Returnpath feedback loop, rather than  
reputation tracking. They're allowing you to sign up for a feedback  
loop for a particular d= value and for either one specific selector or  
all selectors.

When tracking specific issues it may well be useful to get FBL reports  
for just one specific user of a DKIM identity, and being able to key  
on selector seems a good enough way to do that, if a bit of a hack.  
It's not something I'd expect anyone to use normally, though.

I don't believe that Yahoo are using the selector for anything  
reputation related, though, and I wouldn't expect them to do so in  
general. (Not ruling out some ESP-specific hack, if it turned out to  
provide them with useful data, but that would be a private hack rather  
than anything more).

RP or Yahoo might be able to be more authoritative on that.

Cheers,
   Steve

---

From: Dave CROCKER <[email-masked]>
Date: Mon, 25 May 2009 19:57:41 -0700

Steve Atkins wrote:
>    They're allowing you to sign up for a feedback

This is actually pretty interesting.  Feels like a pretty reasonable, if perhaps 
creative, extension of the scope-of-administrative-(not reputation)-control that 
is exactly what I've understood selector to be for.

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Douglas Otis <[email-masked]>
Date: Tue, 26 May 2009 07:08:12 -0700

On May 25, 2009, at 7:14 PM, Steve Atkins wrote:

> loop for a particular d= value and for either one specific selector  
> or all selectors.
>
> When tracking specific issues it may well be useful to get FBL  
> reports for just one specific user of a DKIM identity, and being  
> able to key on selector seems a good enough way to do that, if a bit  
> of a hack.  It's not something I'd expect anyone to use normally,  
> though.

The s= value represents a valid choice for separating feedback  
reports.  The domain may use keys for different purposes, where the s=  
value could be used to establish different priorities.

While d= represents the first element that should be checked for  
reputation, either the i=,  or the author address when the i= is not  
available, could be used as an intra-domain identifier.  Provided the  
domain only has a few bad actors (normally less than one percent for  
well managed domains) a secondary check point would allow a means to  
exclude intra-domain bad actors that might otherwise replay their DKIM  
messages well beyond the normal rate-limits that a provider may have  
established.  The only other alternative strategy would be register  
the the path of the DKIM signatures, but then this would not be as  
robust.  As IP address reputation becomes more complete, the remaining  
avenue for spammers is to utilize provider's main servers.  There are  
enough user systems compromised, that normal rating limiting will not  
be affective.  With respect to DKIM, rate limiting is not effective  
against replay abuse.

Checking the d= value's reputation should provide a high cache hit  
rate.  If this represents a bad-actor, which is likely the case, then  
no other query is required.   When the d= value's reputation indicates  
there is no intra-domain problems, then again no other query is  
required.  However, when intra-domain problems exist, use of the i=  
value or that of the author address converted to a hash could  
represent the next query made.

-Doug

---

From: "J.D. Falk" <[email-masked]>
Date: Wed, 27 May 2009 15:13:52 -0600

> loop for a particular d= value and for either one specific selector or

It'd be more accurate to continue to call it the Yahoo! Complaint Feedback 
Loop.  Return Path hosts the signup page and does a few things in the 
background, but Yahoo! owns the data and the relationships.

> general.

Yep, that's the impression they've given me as well.

-- 
J.D. Falk
Return Path Inc
http://www.returnpath.net/
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html