Subject: [ietf-dkim] Thoughts on ADSP discardable messages BCC'ing the postmaster? (akin to a FBL)

From: Chris Lamont Mankowski <[email-masked]>
Date: Sun, 17 Jun 2012 17:27:30 -0400

I'm reading the archives on ADSP and haven't seen anyone pitch the idea
that on verification failure, we could have the message in question would
be BCC'd to the domain owner's administrator for review.

That way there is no need to rely on 3rd party ADSP reliability lists, and
in the event the domain owner doesn't understand the implications of a ADSP
record, they will quickly be informed of the matter (perhaps with a full
inbox).

If this is a new, and welcome idea, there are many things to discuss such
as the audit message format (does it look like an NDR addressed to some
email address), can the ADSP audit email address point to a separate
domain, and if it is desirable to prevent older verifiers (that are unable
to BCC an audit message) from reading the new, vetted, ADSP policy.

 And while we're at it.. why not add this ability to SPF/SenderID as well?
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Chris Lamont Mankowski <[email-masked]>
Date: Sun, 17 Jun 2012 17:53:02 -0400

I am a new subscriber to this list, and noticed the most recent post (the
one before mine) discussed DMARC, something I haven't heard of before.

At first glimpse, it looks like it may solve the problem I wanted to solve.

---

From: "John R. Levine" <[email-masked]>
Date: 17 Jun 2012 22:01:15 -0400

> be BCC'd to the domain owner's administrator for review.

I am a teenager with a lot of spare time, so I'm going to send thousands 
of random messages forging your domain, so you get copies of all of them.
Perhaps inventing yet another channel for indirect mailbombing is not a 
good idea.

This is not a hypothetical issue -- my abuse.net domain is forged enough 
that I've gotten 400,000 useless bounces in one day to random addresses in 
the domain.  It would not have been useful to get 400,000 more helpful 
notifications to my postmaster address.

By the way, I'm one of the authors of ADSP, and in my opinion, ADSP 
discardable is completely useless.  There are indeed domains whose mail is 
such a phieh target that it's worth losing a few real messages to get rid 
of all the phishes, but ADSP is not an effective way to find out who they 
are.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html