text_combined: qvcimnfiqkwxudxmipassocorg send ietfdkim mailing list submissions gfkyhddlmipassocorg subscribe unsubscribe via world wide web visit httpmipassocorgmailmanlistinfoietfdkim via email send message subject body help qvcimnfiqkwxudxmipassocorg reach person managing list qghtrnrqbhlpvmipassocorg replying please edit subject line specific contents ietfdkim digest todays topics 1 issue 1547 ssp02 mx record publishing mandateto reduce dns overhead ssp discovery detectfraudulent messages damon 2 issue 1547 ssp02 mx record publishing mandateto reduce dns overhead ssp discovery detectfraudulent messages douglas otis 3 issue 1547 ssp02 mx record publishing mandateto reduce dns overhead ssp discovery detectfraudulent messages hector santos 4 issue 1547 ssp02 mx record publishing mandateto reduce dns overhead ssp discovery detectfraudulent messages douglas otis 5 issue 1547 ssp02 mx record publishing mandateto reduce dns overhead ssp discovery detectfraudulent messages hector santos 6 admin mipassocorg dkimorg mailing list host change 21617 16pm pacific tme nonlmuutbbiwnet 7 admin mipassocorg dkimorg mailing list host change 21617 16pm pacific tme dave crocker byfzbhmergmailcom sat apr 26 155236 2008 message 1 date fri 15 feb 2008 184938 0500 damon subject ietfdkim issue 1547 ssp02 mx record publishing mandateto reduce dns overhead ssp discovery detectfraudulent messages hector santos cc dkim list mh michael hammer 5304 messageid 28315622390381732k315i2239qz8v73283h56osfbqmailgmailcom contenttype textplain charsetutf8 case need tie breaker 1 regards damon sauer udcatmailabuseorg sat apr 26 155236 2008 message 2 date fri 15 feb 2008 182805 0800 douglas otis subject ietfdkim issue 1547 ssp02 mx record publishing mandateto reduce dns overhead ssp discovery detectfraudulent messages damon cc mh michael hammer 5304 dkim list messageid 67ce94068e3940e4a497203dd6e57ac4mailabuseorg contenttype textplain charsetusascii formatflowed delspyes feb 15 2008 349 pm damon wrote case need tie breaker 1 summarize bunch 1 says little push back generated concept dkim policy applicable transport protocols might bridged smtp protocol bridging could become problematic email supported natively transmitting domain course also creates problems respect dsns well ignoring problem dsns mandating support smtp accepting smtp message bridged different transport would rather problematic smtp also supported however accepting messages smtp represents choice opens avenue likely permit abuse concern seems somewhat ill founded determining support relevant transport protocol could generally stated using absence protocol discovery record mx case smtp conjunction presence dkim policy record offered means indicate support specific protocol supported means truncate policy discovery process subsequent validation transactions would better protected existing domains involved email traffic generated spoofed messages addition would offered extremely strong refutation fraudulent messages made existing domain strong evidence good thing general settle issue protocol covered dkim policy jim suggested policy scope tag instead would permit domains indicate transport protocols implemented dkim signal dkim policy applied gateways smtp means disavow support transport protocol could important means better limit avenues abuse case message bridged smtp likely find smtp policy applied imho cant helped protocol scope parameter dkim policy could im smtp abuse limited smtp ability clearly indicate whether message fraudulent without incurring additional transactions also important general domain protection standpoint jim right policy made include scope also offers flexible workable solution message abuse demand negotiated changes accommodated extent policy assertions keeping lid added overhead represents remaining challenged doug mwbfbflsantronicscom sat apr 26 155236 2008 message 3 date sat 16 feb 2008 020517 0500 hector santos subject ietfdkim issue 1547 ssp02 mx record publishing mandateto reduce dns overhead ssp discovery detectfraudulent messages douglas otis cc dkim list mh michael hammer 5304 messageid 47b68b2d8020705santronicscom contenttype textplain charsetiso88591 formatflowed douglas otis wrote feb 15 2008 349 pm damon wrote case need tie breaker 1 summarize bunch 1 says little know dont hate call follow chieftain syndrome opinion votes came reason explanation position might help sway others push back generated concept dkim policy applicable transport protocols might bridged smtp doug record mx lookup must ssp record discovery setup imo prefer may even historically requirement therefore highly possible mx exist keep mind steps ssp recommendation long end result people dont follow steps possible mx lookup already done places look way way view keep must mx lookup requirement ssp discovery steps 1 would agree also must addinghaving mx record x822from domain used domains new dkim signing mail operations less problem idea general dkim deployment recommendation domains consider even possibly recommendation mx record x822from standpoint dkimssp protocol consistency especially differs return path sender domains ability clearly indicate whether message fraudulent without incurring additional transactions also important general domain protection standpoint jim right policy made include scope also offers flexible workable solution message abuse demand negotiated changes accommodated extent policy assertions keeping lid added overhead represents remaining challenged 1 youre right important part implementation considerations consider mandate x822from mx must also least allow verifier policy based handling removed current emasculated model since policies allowed implementators optimize scale dkim processing removal reduces mda adoption incentive dkim verification thus little payoff resulting additional overhead less reason even bother overhead sincerely hector santos cto httpwwwsantronicscom httpsantronicsblogspotcom udcatmailabuseorg sat apr 26 155236 2008 message 4 date sat 16 feb 2008 052015 0800 douglas otis subject ietfdkim issue 1547 ssp02 mx record publishing mandateto reduce dns overhead ssp discovery detectfraudulent messages hector santos cc dkim list mh michael hammer 5304 messageid contenttype textplain charsetusascii formatflowed delspyes feb 15 2008 1105 pm hector santos wrote douglas otis wrote feb 15 2008 349 pm damon wrote case need tie breaker 1 summarize bunch 1 says little know dont hate call follow chieftain syndrome opinion votes came reason explanation position might help sway others push back generated concept dkim policy applicable transport protocols might bridged smtp doug record mx lookup must ssp record discovery setup imo prefer may even historically requirement therefore highly possible mx exist horse died leaving barn mx mandate discovery record would imposed domains 1 implemented dkim 2 published dkim policy record scheme impact domains publishing dkim policy records correct mx record may never published cases would nice impose simple limitation domain tree walking polices mandating discovery record mx case smtp published along policy records existence two records provides means detect fraudulent use domain without examining record content approach tolerates policy record format changes still safely minimizing impact daily onslaught spoofed references existing domains even handle messages mandate would offered means squelch series policy key transactions cases invalid signature may occur many reasons leaves result category significantly weaker finding domain publishing policy record without also publishing discovery record technically approach creates problem domain uses dkim publishes policy record support smtp messages converted protocol gateway smtp policy discovery record check would detect smtp supported return path instantiated protocol gateway could provide conversion dsns domain return path would unrelated dkim signature yes might seen disadvantage also closes avenue abuse controlled dkim limitation would induce assurance direct return path domain would indicating dont want protocol translation gives originating domain greater control dummy records might published achieve desired effect keep mind steps ssp recommendation long end result people dont follow steps possible mx lookup already done places mx record queried policy record found check existence domain mx record accessed recently could cache mandate publish policy discovery records together would greater advantage checking mx record look way way view keep must mx lookup requirement ssp discovery steps 1 would agree also must addinghaving mx record x822from domain used domains new dkim signing mail operations logic would way around would seem wg wishes keep options open adding scope policy record effect possible somewhat larger policy records less problem idea general dkim deployment recommendation domains consider even possibly recommendation mx record x822from standpoint dkimssp protocol consistency especially differs return path sender domains represents minority view however ability clearly indicate whether message fraudulent without incurring additional transactions also important general domain protection standpoint jim right policy made include scope also offers flexible workable solution message abuse demand negotiated changes accommodated extent policy assertions keeping lid added overhead represents remaining challenged 1 youre right important part implementation considerations consider mandate x822from mx must also least allow verifier policy based handling removed current emasculated model pairing policydiscovery records content policy record matter preventing spoofing existent domains support smtp hand term discardable instead strict sole exclusive words effect means transactional domains wishing thwart spoofing instead likely find much communications lost take time signature integrity mature problem due mailinglists discardable term likely ensure needed level integrity never occurs much essential feedback whether domain spoofed whether signature integrity problem likely lost since policies allowed implementators optimize scale dkim processing removal reduces mda adoption incentive dkim verification thus little payoff resulting additional overhead less reason even bother overhead dkim value mua scaling overhead much less problem triage process mta could guided policy assertions dkim validation mta may limited domains history targeted abuse domains unwilling make signature assurances filtering must relaxed reduce rate false positives regard appears agreement ssp01 better respect seem problem signatures added thirdparties however admitting understanding thread doug mwbfbflsantronicscom sat apr 26 155236 2008 message 5 date sat 16 feb 2008 112406 0500 hector santos subject ietfdkim issue 1547 ssp02 mx record publishing mandateto reduce dns overhead ssp discovery detectfraudulent messages douglas otis cc dkim list mh michael hammer 5304 messageid 47b70e2610105santronicscom contenttype textplain charsetiso88591 formatflowed douglas otis wrote technically approach creates problem domain uses dkim publishes policy record support smtp well saw thread input since 80s multimail format networkinggateway products served millions course time think pretty good idea practical aspects primarily idea attempting obtain gateway perfection persistent mail integrity dkim transformation processes expecting bit much small part system major framework user option preserve mime yesno preserving mime tells gateway import save mail raw save local proprietary format text separated attachments preserving mime become important years customers users began use offline readers eg pop3 news readers era html mail acceptable another reason users turning option customers security reasons dont even offer option users save users mail native format important comes type mua question keep focus dkim x822 mail system imv regardless x822 mail sent moved gated transformed retransformed still x822 system finally gets ever messages converted protocol gateway smtp policydiscovery record check would detect smtp supported think proposing method domain declare policy says expect mail purported originate qwk fidonet news nntp xyz protocol posted system sounds like good idea think overkill believe benefits using policies restrict 3rd party signatures dkim value mua scaling overhead much less problem depends kind mua referring online offline see vendors deal design implementations many mail reading device methods online offline offline mua different considerations online mua ignore dkim users want pickup mail via pop3 think online users think good reason chaotic discussions subjective product designs imposing feature list everyone else instead focus functional logical points fundamental protocol let implementators decide best fits product lines instead get people mandating cant might ok made sense considerations general case systems really isnt hard either sign dont idea vendor product independent want know domain intended expected asked begin looking new level mail information ok looked see really simple concept always expect 1st signature yeah ok well dont see one reject message sometimes ok fine status quo expect 3rd party signature ok reject dont care ok fine status quo etc etc really dont see matters sent preferred type burglar knocking door sincerely hector santos cto httpwwwsantronicscom httpsantronicsblogspotcom nonlmuutbbiwnet sat apr 26 155236 2008 message 6 date sat 16 feb 2008 165850 0800 nonlmuutbbiwnet subject ietfdkim admin mipassocorg dkimorg mailing list host change 21617 16pm pacific tme dkim ietf wg messageid 47b786ca5030602bbiwnet contenttype textplain charsetiso88591 formatflowed folks scheduled transition mipassocorg dkimorg accounts appears complete sites appear normally accessible receipt email via mailing list final test experience change problem please let know immediately dhcnoticedcrockernet nonlmuutbbiwnet ok might take bit longer see call 14082468253 dave crocker brandenburg internetworking bbiwnet nonlmuutbbiwnet sat apr 26 155236 2008 message 7 date sat 16 feb 2008 164307 0800 dave crocker subject ietfdkim admin mipassocorg dkimorg mailing list host change 21617 16pm pacific tme undisclosedrecipients messageid 47b7831b6040503bbiwnet contenttype textplain charsetiso88591 formatflowed folks scheduled transition mipassocorg dkimorg accounts appears complete sites appear normally accessible receipt email via mailing list final test experience change problem please let know immediately dhcnoticedcrockernet nonlmuutbbiwnet ok might take bit longer see call 14082468253 dave crocker brandenburg internetworking bbiwnet _______________________________________________ note well list operates according end ietfdkim digest vol 107 issue 12 wed 06 aug 2008 074528 0800 ietfdkim digest vol 107 issue 12