Protect domains that don’t send email
The real trick would be if intermediary MTA servers could make the assumption that any domain without SPF/DKIM/etc. has the same intent ("I'm not supposed to be used for sending email") as a domain that explicitly has these "no-email" records. We could eliminate a huge swathe of spam senders from the web in a single stroke. (Right now we already apply this heuristic, but the output is just a signal for spam classifiers at the receiver, rather than a "drop the mail on the floor" signal at intermediates, the way that e.g. DNSRBLs are.)<p>If we <i>did</i> make this "you don't intend to send email if you don't have the secure-origin records" assumption, how much would that break email as a system? What old email servers are sitting around sending unsigned mail, that we want to protect/preserve the functioning of (in the same way we keep Internet-realm HTTP transport around in browsers to preserve access to old HTTP-only Web1.0 servers?)