Subject: Re: [ietf-dkim] DKIM adoption

From: Franck Martin <[email-masked]>
Date: Sun, 2 Aug 2009 16:14:15 +1200 (FJT)

But is ICANN supposed to clean all these random valid domains? 

;) 
----- Original Message ----- 
From: "John Levine" <[email-masked]> 
To: [email-masked] 
Cc: [email-masked] 
Sent: Sunday, 2 August, 2009 3:26:07 PM GMT +12:00 Fiji 
Subject: Re: [ietf-dkim] DKIM adoption 

>Yes the reputation of the domain override things, but what happens when it is 
>the first time a domain is seen? Does DKIM help or not? 

If it did, how many milliseconds do you think it would take spammers to 
start signing with random valid domains? Using wildcards for the key 
records, it's a trivial little programming exercise. 

R's, 
John 
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: John Levine <[email-masked]>
Date: 2 Aug 2009 03:26:07 -0000

R's,
John

---

From: Mark Delany <[email-masked]>
Date: Sat, 1 Aug 2009 22:06:52 -0700

> But is ICANN supposed to clean all these random valid domains?

You half-joke, but one of the arguments we presented to the FTC back  
in 2003 or so regarding spam was that we had an opportunity to  
regulate issuance of domain names. If not regulate, then at least  
insist on an identifiable legal entity being required to register a  
domain.

With that "simple" expedient and wide-spread deployment of DKIM you  
have potential legal recourse to inappropriate email.

ICANN of course couldn't care less as they are in it for the money,  
just as registrars are, but as I understand it, ICANN still operates  
under an MoA from the US Department of Commerce so the opportunity is  
not completely lost, yet.

Unfortunately that opportunity may disappear soon as ICANN are pushing  
hard for complete autonomy,  at which point profit will always be the  
primary motive.

My point being, issuance of domain names could be a choke-point and  
combined with DKIM potentially provides recourse that is currently not  
available. This attacks the opposite end of the spectrum that  
"reputation" focusses on.

Having said that, you could then have reputation systems based on  
jurisdictional recourse. What if you receive traffic from a domain and  
you are able to query for the legal owner of that domain and whether  
you could sue that domain for spamming?

A jurisdictional market for domains could move good senders to  
register in tougher jurisdictions whereas the bad guys would stay well  
clear. Just as companies today decide whether to register on the NYSE  
or in the Cayman Islands.

Just another arrow in the quiver, but a useful one methinks.

Mark.

---

From: "John R. Levine" <[email-masked]>
Date: Sun, 2 Aug 2009 07:30:44 -0400 (EDT)

> But is ICANN supposed to clean all these random valid domains?

Ahem.  Domain is not a synonym for top-level or second-level domain. 
These are all domains:

foo.badguy.com
bar.badguy.com
baz.badguy.com
goo.badguy.com

Don't even think of suggesting that domains are the "same" if the last N 
components are the same, until you have read and understood the endless 
discussions here and elsewhere of why that doesn't work.

R's,
John

---

From: "John R. Levine" <[email-masked]>
Date: Sun, 2 Aug 2009 07:38:13 -0400 (EDT)

> You half-joke, but one of the arguments we presented to the FTC back in 2003 
> or so regarding spam was that we had an opportunity to regulate issuance of 
> domain names. If not regulate, then at least insist on an identifiable legal 
> entity being required to register a domain.

Without going into the rococo nightmare that is ICANN politics, forget it. 
Beyond the fact that ICANN has no interest in making it harder to register 
domains (other than perhaps via incremental price increases), they only 
set the rules for generic TLDs, three letters and longer, not two-letter 
country code TLDs.

The Joint Project Agreement with the US government isn't going away any 
time soon, and the US government has always been in favor of more 
accountability, e.g., the .US domain forbids proxy registrations, but it's 
political problem due to privacy laws in the EU and Canada protecting 
domains that at least claim to be registered by individuals.

R's,
John

---

From: Douglas Otis <[email-masked]>
Date: Mon, 03 Aug 2009 13:31:37 -0400

On 8/2/09 1:06 AM, Mark Delany wrote:
> You half-joke, but one of the arguments we presented to the FTC back in
> 2003 or so regarding spam was that we had an opportunity to regulate
> issuance of domain names. If not regulate, then at least insist on an
> identifiable legal entity being required to register a domain.

Rather than viewing control of a domain as indicative of good email 
behavior, positive reputations based upon histories of DKIM signatures 
could offer an alternative or enhancement to methods currently used in 
the disposition of messages.

As SMTP transitions into the use of IPv6, IP address reputations will 
also need to rapidly transition to a positive mode of assessment as 
perhaps the only method that has a chance to scale in the face of new 
levels of abuse.

It might be interesting to review information exchanged during DKIM 
assessment, such as a hash of the i= value in conjunction with the DKIM 
key location.  Perhaps a new industry standard could be adopted in this 
regard.  It might be interesting to find whether there might be interest 
in developing third-party authorization schemes.

-Doug

---

From: Mark Delany <[email-masked]>
Date: Mon, 3 Aug 2009 11:01:13 -0700

On Aug 3, 2009, at 10:31 AM, Douglas Otis wrote:

> behavior, positive reputations based upon histories of DKIM  
> signatures could offer an alternative or enhancement to methods  
> currently used in the disposition of messages.
>

That's entirely orthogonal and nothing new. My point was something  
stronger and different from "reputation", namely something  
jurisdictional; can I find (and sue) the owner of the domain on the  
DKIM signature?

Mark.

---

From: Michael Thomas <[email-masked]>
Date: Mon, 03 Aug 2009 12:17:10 -0700

> jurisdictional; can I find (and sue) the owner of the domain on the

I think that it's larger than that: Given a domain name, what can we
educe from it?

1) who the registrant?
    o how long has it been around
    o etc, etc
2) who is the registrar?
    o how hard is it to mass-enroll domains?
    o are they known to turn a blind eye to spammers?

etc, etc. That is, start looking up the food chain for bad behavior.
Until there are negative consequences, registrars will take the free
if smelly money. What can we do to create a negative consequence?

	Mike

---

From: Douglas Otis <[email-masked]>
Date: Mon, 03 Aug 2009 13:18:03 -0700

On 8/3/09 11:01 AM, Mark Delany wrote:

> jurisdictional; can I find (and sue) the owner of the domain on the DKIM
> signature?

An ISP might, but recipients had their legal standing removed by 
CAN-SPAM.  Regardless, reputation would be more cost effective.

-Doug