Subject: [ietf-dkim] On the Selector

From: Franck Martin <[email-masked]>
Date: Tue, 26 May 2009 07:42:10 +1200 (NZST)

Hi, 

I see some ESP are using the selector to do domain reputation. We used to have a reputation based on the IP, but with DKIM based reputation, it is more difficult to have a granular reputation, therefore the use of the selector to differentiate emails. 

Is the use of the selector for this purpose codified somewhere? 

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Dave CROCKER <[email-masked]>
Date: Mon, 25 May 2009 13:27:59 -0700

Using the selector as input to a reputation process is a serious mistake.  It is 
discussed briefly in the Overview, which was just approved by the IESG:

    <http://dkim.org/specs/draft-ietf-dkim-overview-11.html#rfc.section.4.3>

Basing assessment on a value that includes the selector destroys the ability to 
use the selector for key management.

d/

Franck Martin wrote:
> Hi,
> 
> I see some ESP are using the selector to do domain reputation. We used 
> to have a reputation based on the IP, but with DKIM based reputation, it 
> is more difficult to have a granular reputation, therefore the use of 
> the selector to differentiate emails.
> 

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Franck Martin <[email-masked]>
Date: Tue, 26 May 2009 09:24:27 +1200 (NZST)

someone should tell yahoo then ;) 

What would you use then? 

----- Original Message ----- 
From: "Dave CROCKER" <[email-masked]> 
To: "Franck Martin" <[email-masked]> 
Cc: [email-masked] 
Sent: Tuesday, 26 May, 2009 8:27:59 AM GMT +12:00 New Zealand 
Subject: Re: [ietf-dkim] On the Selector 

d/ 

-- 

Dave Crocker

---

From: Dave CROCKER <[email-masked]>
Date: Mon, 25 May 2009 14:50:14 -0700

d=

-- 

   Dave Crocker

---

From: Steve Atkins <[email-masked]>
Date: Mon, 25 May 2009 15:46:15 -0700

On May 25, 2009, at 12:42 PM, Franck Martin wrote:

> Hi,
>
> I see some ESP are using the selector to do domain reputation.

In what way? Given that the selector is an opaque string, are you  
reading something into their choice of selectors that isn't there, or  
are they documenting that they intend meaning for their selectors?

> We used to have a reputation based on the IP, but with DKIM based  
> reputation, it is more difficult to have a granular reputation,  
> therefore the use of the selector to differentiate emails.
>

"Don't do it. Use a subdomain."

Cheers,
   Steve

---

From: Franck Martin <[email-masked]>
Date: Tue, 26 May 2009 11:06:33 +1200 (NZST)

Not really convenient. 

It would mean a domain name for each class of emails (eg corporate email, newsletter to customers) 

I'm not sure why using the selector would be a bad idea, if a key gets revoked the reputation falls to zero, and when a receiver sees a new key then it may assume no reputation and will build a new one based on traffic. I think this does no hinder key management. 

----- Original Message ----- 
From: "Dave CROCKER" <[email-masked]> 
To: "Franck Martin" <[email-masked]> 
Cc: [email-masked], [email-masked] 
Sent: Tuesday, 26 May, 2009 9:50:14 AM GMT +12:00 New Zealand 
Subject: Re: [ietf-dkim] On the Selector 

d=

---

From: Steve Atkins <[email-masked]>
Date: Mon, 25 May 2009 16:17:25 -0700

On May 25, 2009, at 4:06 PM, Franck Martin wrote:

> I'm not sure why using the selector would be a bad idea, if a key  
> gets revoked the reputation falls to zero, and when a receiver sees  
> a new key then it may assume no reputation and will build a new one  
> based on traffic. I think this does no hinder key management.

If changing a selector will damage delivery rates (by trashing the  
reputation of the sender) then ESPs will never change selectors, and  
hence keys. You don't get much more of a hindrance to key management  
than that.

Cheers,
   Steve

---

From: Dave CROCKER <[email-masked]>
Date: Mon, 25 May 2009 16:29:45 -0700

> email, newsletter to customers)

yup.  that's the design of the system.

and by the way, in terms of DNS management, a selector is a sub-domain name, so 
it's the same administrative effort as a subdomain for d=.

> I'm not sure why using the selector would be a bad idea, 

that would imply a new reputation to be developed each time a key is replaced 
(and therefore a new selector is assigned.)  Key changes can and should happen 
regularly.  And different keys might be assigned to different people, for the 
same mail stream.

d/
-- 

   Dave Crocker