Subject: RE: Alternative to TXT or new RR

From: "Bob Atkinson" <[email-masked]>
Date: Fri, 11 Jun 2004 18:03:38 -0700

> I agree, MARID can't claim the TXT RR for it's own. 

Let's be clear; this is NOT the plan of record in the current draft.

Rather, MARID is claiming the COMBINATION of a particular domain prefix
and TXT as it's own.

	Bob

---

From: "Gordon Fecyk" <[email-masked]>
Date: Mon, 14 Jun 2004 08:25:15 -0500

> FWIW, there's been an interesting little thread on SPF 
> problems caused by non-SPF stuff in TXT here:

The problem described there looks like an implementation error only.  The
parser that Michael was using that failed didn't take into account additional
records with non-SPF information.

While RFC 1464 is one way to distinguish useful information from not useful
information, it isn't the only way.  Other unique tokens identifying MARID
records would work.  

-- 
PGP key (0x0AFA039E): <http://www.pan-am.ca/[email-masked]>
Sometimes it's hard to tell where the game ends and where reality bites,
er, begins. <http://vmyths.com/resource.cfm?id=50&page=1>

---

From: "Jon Kyme" <[email-masked]>
Date: Fri, 18 Jun 2004 13:12:16 +0100

> Given the nature of what we are working on, we need to know who has the
> White Paper and how to get in touch with them aside from email.  What is
> your objection to registering for it?  Would you like me to mail it to
> you directly?
> 

No, thank you. 

Incidentally, wasn't it suggested that asrg would be more interested in
your scheme? This group's charter has more to do with authorisation than
authentication.

---

From: "Jon Kyme" <[email-masked]>
Date: Fri, 18 Jun 2004 16:22:48 +0100

Bill Mcinnis wrote:
> I think what we are working on falls into the authorization part of this
> charter, unless I have that defined wrong. Could someone please explain
> the difference as you all see it just so I am clear.  Again, I am trying
> to find the right place to go with this and keep getting shot down.  It
> is frustrating because while you all are talking about getting working
> code, we already have it.
>

AFAIK "Message Level Authentication", is concerned with answering "the
fundamental question plaguing email today: 'Did you really send me this
email?'", whereas this group has a charter to come up with a mechanism to
enable "those maintaining domains and networks
[...] to specify that individual hosts or nodes are authorized
to act as MTAs for messages sent from those domains or networks"

This difference may be easier to understand if you consider how you'd use
either system *without* a message in hand:

MARID:
Q.  domain name, IP 
A.  Yes | No

Message Level Authentication:
Q. Did you really send me this email?
A. What email? What are you on about? Are you on drugs?

Regards,
JRK

---

From: "Jon Kyme" <[email-masked]>
Date: Fri, 18 Jun 2004 16:57:47 +0100

> why not have a mechanism that can sit on their domain and
> verify to those asking if a message came from their domain or network

Why not indeed, however, a mechanism for answering that question probably
isn't in scope here.

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 18 Jun 2004 10:13:23 -0700

> Why not indeed, however, a mechanism for answering that 

We need some form of reporting function for exceptions. If my site
is being phished I would like to be told.

"Got message serial # wqwqkjwheqwekjh, failed MARID verification"

"Thank you"
or
"Oh that was genuine, must be a relay"

Should consider this at recharter time.

---

From: "Bill Mcinnis" <[email-masked]>
Date: Fri, 18 Jun 2004 16:43:39 -0400

Reposting as it did not go out to the list

Fair enough.  I just wanted to explain why I popped my head up (potential IP issues with some of the things I have read recently), call out for those interested in helping with what we have developed and address your follow up questions/comments.  Is there a group that this would fit into as the ASRG doesn’t seem to be a fit either?  We seem to still be a few steps ahead, but things keep moving ever so closely in our direction.

Jon, thank you very much for your comments and questions.

Bill McInnis
Messagelevel.com

-----Original Message-----
From: Jon Kyme [mailto:[email-masked]] 
Sent: Friday, June 18, 2004 11:58 AM
To: Bill Mcinnis
Cc: [email-masked]
Subject: RE: Alternative to TXT or new RR

> why not have a mechanism that can sit on their domain and verify to
> those asking if a message came from their domain or network

Why not indeed, however, a mechanism for answering that question probably isn't in scope here.

----
This outgoing message is guaranteed to be authentic by MessageLevel users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.

---

From: "Bill Mcinnis" <[email-masked]>
Date: Fri, 18 Jun 2004 16:45:20 -0400

We have already given thought to that and have reporting set up to see what failed the query on the sites we are beta-ing this between.  Naturally it only works between sites that have it running.  But, in the last 3 weeks alone we have stopped over 15,000 spoof attacks amongst the sites (people pretending to be one of the sites we have it running on and trying to email that site or one of the others in the network) with 0 false positives.

Bill McInnis
Messagelevel.com

-----Original Message-----
From: Hallam-Baker, Phillip [mailto:[email-masked]] 
Sent: Friday, June 18, 2004 1:13 PM
To: 'Jon Kyme'; Bill Mcinnis
Cc: [email-masked]
Subject: RE: Alternative to TXT or new RR

> probably isn't in scope here.

We need some form of reporting function for exceptions. If my site is being phished I would like to be told.

"Thank you"
or

----