text_combined: per jessen ueecomputerorg mepsczpargmxnet wrote need clean tmp vartmp tmp directories without clean restart servers running 24x7 snip suggestions welcome every 24hours find tmp vartmp atime 1 xargs rm rf per jessen zürich httpwwwspamchekcom spam business udcatmailabuseorg sat apr 26 154932 2008 message 2 date mon 3 mar 2008 133441 0800 douglas otis subject ietfdkim proposed issues addressed ssp03 closure jim fenton cc ietf dkim wg messageid 4db5959d12984ad2a5475a0b3660aa94mailabuseorg contenttype textplain charset mar 1 2008 655 jim fenton wrote id like shorten list open issues ill start issues consider clearly moot asp draft ssp03 duplicates issues hopefully non controversial wg chairs id like ask direct closure following issues subject wg consensus course 1399 clarify duplicate 1519 disagree issue 1399 suggests ipolicy however lacks details issue 1519 notes ssp policy requirements conflicts rfc 4871 recommends restrictions ikeys per dkim charter outofscope topics signatures attempt make strong assertions identity message author details userlevel signing messages distinguished domainlevel keys restricted specific users duplication prior work signed email including smime openpgp despite outofscope ssp author signature definition dramatically changes ichange isignatures containing localpart identity must behalf entity within header rfc4871 never stipulated valid signatures associated identity contain emailaddress found within messages headers identity specifically within header compatibility rfc 4871 achieved using identity ambiguous signatures many cases leaving verifiers guess wrongly cases looking header stack retain specificity non header identities separate signature required must properly overlap ambiguous signature _no_ reason assume providers make assertions regarding specific identity messages author providers may wish compelled use opaque tokens instead whether identity assertions made scope dkim surprisingly limitations identity assertions limited specific emailaddresses within header ssp compliance compatible rfc 4871 either addition scope use iagent whose behalf signature made offers significant level protection receivers protection help curb abuse compromised systems especially users permitted send messages irrespective identities within headers abuse normally controlled identifying abusers constraining domains users messages level constraint used remain within purview signing domains protection afforded valid even tokenized onbehalfof identity lost result change imposed author signature definition definition demands _less_ information conveyed signature domain may wish assert messages signed raise scrutiny given unsigned messages domain nevertheless identity author remains independent totally separate issue ironically definition inhibits use identities introducing message whose behalf signature added also found within header issues related spoofing author still remains within signing domains purview prevented signing spoofed abusive messages justification limit compliant signatures identities found within header would messages signed gcompliant regardless policy domain publishes messages easily represent abuse beyond signing domains purview flagging messages noncomplaint would impose significant security risk fully independent ssp policy assertions author identities ssp stipulate signatures containing identities found within header signed gwith _any_ domain signing policy addition stipulations depend upon whether policy published doug kiteciscocom sat apr 26 154932 2008 message 3 date mon 03 mar 2008 134429 0800 eliot lear subject ietfdkim proposed issues addressed ssp03 closure jim fenton cc gfkyhddlmipassocorg messageid 47cc713d1090701ciscocom contenttype textplain charset jim fenton wrote sure difference new open see whole list clicking dkim link right side home page links real difference point dyrbcmciscocom sat apr 26 154932 2008 message 4 date mon 03 mar 2008 135109 0800 jim fenton subject ietfdkim asp 422 step 2 name existence check nonlmuutbbiwnet cc dkim list messageid 47cc72cd10802ciscocom contenttype textplain charset dave crocker wrote gday reviewing posts response iab draft finding unclear reasons step 2 query procedure asps section 422 im pretty sure merely caffeinedeficiencybased question functional security reason verifying domain exists terms asp imagine obvious reasons outside asp would need documented asp least would help document include text explains benefit step came remember translation new rr type prefixed txt query asp published using rr type one query gets asp record find whether domain exists substitute prefixed txt query need query domain without prefix want find checking existence domain clearly useful thing could considered scope asp check existence domain since nonexistent domain naturally signing practices record already know another justification might caching id need find negative caching works would negative response _asp_domainkeynonexistentexamplecom result negative cache entry nonexistentexamplecom step 2 might occur quickly locally potentially eliminating step 3 query parent would probably cached jim gsdszblightycom sat apr 26 154932 2008 message 5 date mon 3 mar 2008 135923 0800 steve atkins subject ietfdkim name existence vs asp dkim list messageid 98555f52e94247498b4719702ed51919blightycom contenttype textplain charset mar 3 2008 1238 pm john levine wrote functional security reason verifying domain exists terms asp short answer 32 theres different answer dunno doesnt exist recall always way thats good question theres certainly plenty reasons wary mail return address doesnt exist baking asp feel like mission creep doesnt recall discussion correctly without check absence asp record perceived mean domain owner permitted mail sent hostname adding check existence record hostname means order deploy asp sender needs provide txt record corresponding every hostname use every conceivable hostname impossible useful manner standard dns servers concrete example asp record creditcardbillingebaycom without domain existence check would difficult ebay assert aspstyle policy domains cheers steve udcatmailabuseorg sat apr 26 154932 2008 message 6 date mon 3 mar 2008 145848 0800 douglas otis subject ietfdkim asp 422 step 2 name existence check jim fenton cc nonlmuutbbiwnet dkim list messageid contenttype textplain charset mar 3 2008 151 pm jim fenton wrote dave crocker wrote gday reviewing posts response iab draft finding unclear reasons step 2 query procedure asps section 422 im pretty sure merely caffeinedeficiencybased question functional security reason verifying domain exists terms asp imagine obvious reasons outside asp would need documented asp least would help document include text explains benefit step came remember translation new rr type prefixed txt query asp published using rr type one query gets asp record find whether domain exists substitute prefixed txt query need query domain without prefix want find test made querying mx record domain question domain exist reason check parent domain policy records mandating use mx records publishing policy records climb domain tree completely avoided checking existence domain clearly useful thing could considered scope asp check existence domain since nonexistent domain naturally signing practices record already know avoiding policy check parent would scope would another justification might caching id need find negative caching works would negative response _asp_domainkeynonexistentexamplecom result negative cache entry nonexistentexamplecom step 2 might occur quickly locally potentially eliminating step 3 query parent would probably cached see rfc 2308 negative caching certain positive caching mx record checked prior walking domain tree negative caching retrained long minimum field soa record ttl soa whichever less resolvers rfc 2308 compliant truncate duration negative caching limit effects transient network failures doug dyrbcmciscocom sat apr 26 154932 2008 message 7 date mon 03 mar 2008 165459 0800 jim fenton subject ietfdkim issue 1547 mx records asp 422 step 2 name existence check douglas otis cc nonlmuutbbiwnet dkim list messageid 47cc9de35070100ciscocom contenttype textplain charset douglas otis wrote mar 3 2008 151 pm jim fenton wrote dave crocker wrote gday reviewing posts response iab draft finding unclear reasons step 2 query procedure asps section 422 im pretty sure merely caffeinedeficiencybased question functional security reason verifying domain exists terms asp imagine obvious reasons outside asp would need documented asp least would help document include text explains benefit step came remember translation new rr type prefixed txt query asp published using rr type one query gets asp record find whether domain exists substitute prefixed txt query need query domain without prefix want find test made querying mx record domain question domain exist reason check parent domain policy records mandating use mx records publishing policy records climb domain tree completely avoided proposed domains publishing asp records required publish mx records case domain perhaps host published asp record could requirement mx checking existence domain clearly useful thing could considered scope asp check existence domain since nonexistent domain naturally signing practices record already know avoiding policy check parent would scope would perhaps clear advantage checking existence domain vs querying parent explore following paragraph another justification might caching id need find negative caching works would negative response _asp_domainkeynonexistentexamplecom result negative cache entry nonexistentexamplecom step 2 might occur quickly locally potentially eliminating step 3 query parent would probably cached see rfc 2308 negative caching certain positive caching mx record checked prior walking domain tree negative caching retrained long minimum field soa record ttl soa whichever less resolvers rfc 2308 compliant truncate duration negative caching limit effects transient network failures case query would benefit negative caching occurs immediately within milliseconds first query shouldnt significant ttl issues jim dyrbcmciscocom sat apr 26 154932 2008 message 8 date mon 03 mar 2008 164424 0800 jim fenton subject ietfdkim proposed issues addressed ssp03 closure douglas otis cc ietf dkim wg messageid 47cc9b689070205ciscocom contenttype textplain charset clear proposing close 1399 duplicate 1519 way around jim douglas otis wrote mar 1 2008 655 jim fenton wrote id like shorten list open issues ill start issues consider clearly moot asp draft ssp03 duplicates issues hopefully noncontroversial wg chairs id like ask direct closure following issues subject wg consensus course 1399 clarify duplicate 1519 disagree issue 1399 suggests policy however lacks details issue 1519 notes ssp policy requirements conflicts rfc 4871 recommends restrictions keys udcatmailabuseorg sat apr 26 154932 2008 message 9 date mon 3 mar 2008 183530 0800 douglas otis subject ietfdkim issue 1547 mx records asp 422 step 2 name existence check jim fenton cc nonlmuutbbiwnet dkim list messageid 6222e6397dc34b13a61b1ac162d694ecmailabuseorg contenttype textplain charset mar 3 2008 454 pm jim fenton wrote douglas otis wrote mar 3 2008 151 pm jim fenton wrote came remember translation new rr type prefixed txt query asp published using rr type one query gets asp record find whether domain exists substitute prefixed txt query need query domain without prefix want find test made querying mx record domain question domain exist reason check parent domain policy records mandating use mx records publishing policy records climb domain tree completely avoided proposed domains publishing asp records required publish mx records case domain perhaps host published asp record could requirement mx requiring mx records coupled dkimsmtp policy records means existing domains without mx policy records thereby indicate policy asserted domain importantly result reached without climbing domain tree conversely policy record discovered without mx record checks parent domains also prevented important safety features missing present dkim policy discovery algorithm checking existence domain clearly useful thing could considered scope asp check existence domain since nonexistent domain naturally signing practices record already know avoiding policy check parent would scope would perhaps clear advantage checking existence domain vs querying parent explore following paragraph second third level domains might millions emailaddress domains could cause dkim policy discovery processes invoked algorithm makes requests nonexistent records within parent domains generate fair amount new highly distributed overhead nonbeneficial traffic cause unnecessary processing delays another justification might caching id need find negative caching works would negative response _asp_domainkeynonexistentexamplecom result negative cache entry nonexistentexamplecom step 2 might occur quickly locally potentially eliminating step 3 query parent would probably cached see rfc 2308 negative caching certain positive caching mx record checked prior walking domain tree negative caching retrained long minimum field soa record ttl soa whichever less resolvers rfc 2308 compliant truncate duration negative caching limit effects transient network failures case query would benefit negative caching occurs immediately within milliseconds first query shouldnt significant ttl issues agreed soa record ttl represent significant concern however fairly significant percentage dns resolvers fully adhere rfc 2308 reliance upon negative caching minimized words negative caching expected terminate walks domain tree searching seldom published records doug _______________________________________________ note well list operates according wed 06 aug 2008 054644 0100 opensuse cleaning tmp without restarting servers