Subject: RE: [Asrg] Accreditation Mechanism Proposal

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 18 Mar 2004 11:14:26 -0800

> You mean when querying the accreditation service?
> How would this interact with Verisign's publishing of wildcard
> records (e.g. if the accreditation service goes out of business and
> its domain name is revoked)? 

Given that 20 odd TLDs publish wildcard records today this looks
like a problem regardless of what might happen in any given domain.

This is what happens when you have what the DNS folks call a DNS
hack.

> This goal of indirect identification of accreditation services seems
> like a positive thing.  Has there been any attempt to analyze the
> additional overhead?

I don't think it is large. You simply keep a log of the citations
of unknown accreditation services. You feed it back in every now
and again and look to see if you should track them.

> Also, as with SPF et al there is the question of feedback from the
> recipient: e.g. one might want to have the ability for the recipient
> to publish information about what that recipient requires of a
> sender.  Some unified scheme might be useful, like:
> 
>     ( Sender domain must publish SPF OR DMP
>     AND Sender must be accredited by any two of {abc, def, ghi, xyz}
>     AND Sender IP must publish MTAMark)
>     OR  ( Sender must accept address verification probe )
> 
> but that's probably a whole nother effort.

I think that is essentially mirroring the WS-Policy work in
web services land.

> Pretty bold assertion :-)
> It hasn't held true with some DNSBL services.  Among other reasons is
> the wide variety of definitions of "incorrect," as well as extremely
> polar opinions about listing criteria, remedies, 
> responsibility, et al.

That why I want to avoid static listing. The accreditation services
must be accountable.

> Red flag:  better would be "these bits are reserved and must be set
> to zero."  If you don't guarantee they are zero from the outset,
> it's hard to make sure you can use them in the future.

I don't want acceptors to assume that they will be zero. I want 
them to be ignored.

> Do you really anticipate using NAPTR?

Hey look who is the co-chair of the MARID-WG...

		Phill

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Olson, Margaret" <[email-masked]>
Date: Fri, 19 Mar 2004 08:11:51 -0500

>My issue with this is something else - if all of this becomes prevalent 
>enough, aren't we essentially raising a barrier of entry for new domains 
>on the Internet? Doesn't such accredidation service essentially become a 
>gatekeeper for the Internet?

My belief - which makes some assumptions about how accreditation is
implemented - is that the barrier to running your own mail server will go
up, but not necessarily having your own domain. Many people today have a
domain and outsource all aspects of running it to some other organization
(or organizations). By aggregating small domains an outsource provider
should be able to keep the prices close to what they are today. 

One thing that I noticed that has not been widely addresses in accreditation
discussions, and which I think should be addressed, is controlling the
reward side of the spam equation. If you can accredit the mail servers and
the sending domains separately, then a receiving system can reasonably know
that mail originating from clients of example.com from the set of servers at
"small.example.com" are limited to some number of messages per day. 

If you can control the reward side of the equation, then sending domains
using outsourced providers don't need much in the way of an accreditation -
they just need to state "we use small.example.com", which for a small sender
tells the receiver something really useful. You can also envision something
along these lines without actually outsourcing - an ISP that is accredited
to limit SMTP traffic coming out of their network on a per client basis.

This does presume that there is a specific accreditation for mail service
providers of all kinds. There are other types of organizations that could
also benefit from industry specific accreditations as well - financial
organizations and political/free speech organizations spring to mind
immediately.

Just to be clear, I am not assuming that the accrediting agency attempt to
guess volume when accrediting and monitoring organizations that run mail
servers. I'm assuming they have a contract that permits them to walk in to
the network center and investigate when ever they want, and some sort of
audit process.

What I have outlined here primarily addresses the needs small commercial
domains that are already outsourcing their mail services for a variety of
technical and business reasons. It does not address the small mail or list
server run by a knowledgeable individual. Do the puzzle type solutions cover
this case? 

Margaret.

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 19 Mar 2004 09:43:22 -0800

I can assure folk I am not in the business of raising the barrier to people
having their own domain names. The number of domain name owners running
their own mail servers is vanishingly small.

Actually I think Margaret is wrong here. With accreditation the barrier to
running your own mail server goes down dramatically, thats the whole idea.
At the moment the biggest cost you have in running your mail service is
getting your name onto whitelists after some totally unaccountable blacklist
listed you because somebody did not happen to like your ISP.

I don't think that very many people are going to need the expensive high end
accreditation services that people like Margaret are using. If you are not a
bulk email sender the cost of accreditation should not be an issue. Sure it
will cost a lot to police the bulk senders, but not the people who don't do
anything that looks spammy.

        Phill