Subject: Re: [ietf-dkim] DKIM adoption

From: Paul Russell <[email-masked]>
Date: Sun, 02 Aug 2009 08:33:19 -0400

On 8/1/2009 00:17, Franck Martin wrote:
> I was curious by Scott comment re SPF.
> 
> Is there a class of spam that cannot get a DKIM signature?
> 
> I would think botnets would be that class, as they usually infect 
> computers and not sure they could DKIM sign as it would require them
> to set a DNS entry too. Knowing that botnets are 70% of spam, if DKIM
> could solve this one it would be great.

You will not eliminate botnet spam by requiring a valid DKIM signature on every
message accepted your mail servers.  DKIM signatures are associated with
domains, not sending IP addresses or the DNS hostnames associated with those IP
addresses.  Spammers register countless domains every day; they could easily
generate and publish DKIM keys for those domains.  The spamware used on zombies
could be modified to use sender addresses in those domains and generate DKIM
signatures for outbound messages.  There is no technical reason why it could not
be done.  On the other hand, in the absence of wide-spread adoption of DKIM by
legitimate senders, there is little, if any, incentive for spammers to move in
this direction, because it eliminates their ability to used bogus/forged sender
addresses in domains they do not control.

There are techniques which can be used to block most spam from botnets, without
the overhead of validating DKIM signatures.  Most, if not all, of these
tecniques have non-zero FP rates, but some sites have decided that the benefits
of these techniques outweigh the costs.

> so my question to add to your question "Does the presence of a signature 
> provide any objective data about the goodness or badness of the signer?" is:
> is there a class of spam that cannot get a DKIM signature?

Probably not.  But DKIM is not designed to provide a message recipient with
the ability to determine whether a message is spam; it is designed to provide a
message recipient with the ability to determine whether a message was sent by
the apparent sender.

-- 
Paul Russell, Senior Systems Administrator
OIT Messaging Services Team
University of Notre Dame
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Dave CROCKER <[email-masked]>
Date: Mon, 03 Aug 2009 12:46:02 -0700

> message recipient with the ability to determine whether a message was sent by

Since your caution constructively seeks to pay attention to what DKIM is *not* 
and especially since that goes against most folks' expectations for DKIM, it's 
tempting simply to agree.

Strictly speaking, however, the 'apparent sender' reference is likely to be 
problematic since those same "most folks" will think it means the author (From: 
field) and it might or might not.

The signing does not even have to be a direct handler of the message, per the 
Goodmail form signing "on behalf of" the author's organization.

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html