Subject: But what about accreditation/reputation?

From: Jim Fenton <[email-masked]>
Date: Tue, 17 Aug 2004 11:11:30 -0700

I agree that the discussion on the merits/deficiencies of various accreditation services belongs elsewhere, but this prompts another question.  Once there is at least some degree of trust in domain-level email source addresses, there will be a need for some way to evaluate those addresses.  Otherwise spammers can just buy and use disposable domains (and advertise Sender-ID, of course).  This is what Meng is getting at in his "aspen" document.

I see a whole ecosystem of accreditation services (some new, some old) springing up once MARID (and similar mechanisms, e.g., MASS) get adopted.  I expect they will have different business models and will use different criteria for rating the addresses.  Some might require the posting of a bond, others might rate based on what other recipients of mail say (true reputation), and others might be based on criteria like how long the domain has been in existence.

It would be good to have common mechanisms for accessing this accreditation data, so that the services can compete freely and recipients can easily use the service that is best for them.

Does this make sense as a future work item for the (presumably rechartered) MARID WG?  Or does this sound like a separate WG?  As mentioned above, MASS will need the same thing.

-Jim

---

From: John Levine <[email-masked]>
Date: 17 Aug 2004 19:35:16 -0000

>It would be good to have common mechanisms for accessing this
>accreditation data, so that the services can compete freely and
>recipients can easily use the service that is best for them.

This is exactly what I've been hoping the ASRG IAR group would
work on.

Since there is very little existing reputation service practice beyond
DNSBLs, it seems to me way too early to try to staandardize anything.
What we need is experiments to see what works and what doesn't, you
know, like in olden days.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
http://www.taugh.com

PS: If you're interested in IAR, see http://asrg.sp.am/subgroups/iar.shtml

---

From: Rand Wacker <[email-masked]>
Date: Tue, 17 Aug 2004 19:09:17 -0400

> It would be good to have common mechanisms for accessing this accreditation data, so that the services can compete freely and recipients can easily use the service that is best for them.

"Yes"

> Does this make sense as a future work item for the (presumably rechartered) MARID WG?  Or does this sound like a separate WG?  As mentioned above, MASS will need the same thing.

"No, Yes" (please lets not do it here)

FWIW, a quick survey of the nascent accreditation/reputation service 
market (bonded sender/senderbase, cloudmark rating, verisign's upcoming 
accreditation list, numerous open community projects) reveals a strong 
disposition of using DNSL-like protocols.  Unfortunately, while the 
query mechanism is standard, the query format and result are not 
necessarily so.

-Rand

---

From: Dave Crocker <[email-masked]>
Date: Wed, 18 Aug 2004 00:09:05 -0700

Rand,

RW> disposition of using DNSL-like protocols.  Unfortunately, while the 
RW> query mechanism is standard, the query format and result are not 
RW> necessarily so.

 sure would be nice to get some feedback on CSV's DNA specification...

d/
--
 Dave Crocker <dcrocker-at-brandenburg-dot-com>
 Brandenburg InternetWorking <www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>