Subject: RE: Alternative to TXT or new RR

From: "Bill Mcinnis" <[email-masked]>
Date: Thu, 17 Jun 2004 10:17:18 -0400

I have not had a chance to read this list for a week or so, 
and have not been able to trace this thread with any ease, can 
someone summarize what started this thread, because I am reading a lot
of bits and pieces that sound like what we have.

Thanks,

Bill McInnis
www.messagelevel.com
Message Level Authentication

---------- Original Message ----------------------------------
From: "Jon Kyme" <[email-masked]>
Date:  Wed, 16 Jun 2004 23:04:59 +0100

>
>> 
>> > Therefore, RPC-to-publisher is at least as capable as SPF-like
>> schemes.
>> There are a lot of small domains out there.  I believe that we can get
>> many of them to take 5 minutes to add a DNS record.  But getting them to
>> install new software, and configure a new web service, is way past the
>> ability of many of them.
>> 
>
>Then they'd need to rely on the services of a third party (which is what
>might happen with reputation services anyway), or not benefit. So this
>isn't, on the face of it, a meaningful objection.
>
>
>

----
This outgoing message is guaranteed to be authentic by MessageLevel users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.

---

From: Arnt Gulbrandsen <[email-masked]>
Date: Thu, 17 Jun 2004 16:48:43 +0200

Bill Mcinnis writes:
> I have not had a chance to read this list for a week or so, and have 
> not been able to trace this thread with any ease, can someone 
> summarize what started this thread, because I am reading a lot of 
> bits and pieces that sound like what we have.

SPF is like this: The message recipient figures out a sending domain, 
does a DNS lookup, receives an SPF program, interprets that program, 
and finally makes a decision. CID is much the same.

I suggested an alternative: The message recipient figures out a sending 
domain, does a DNS lookup, receives the location of a server, asks that 
server whether a message from IP address so-and-so is permitted to have 
sender so-and-so, receives an answer, and makes a decision.

The advantages: 1) that there is no longer an entire language in the 
MARID spec, 2) there is absolutely no need for a new RR, 3) programs 
aren't being shipped around the net to be executed by sundry mail 
receivers, 4) the domain owner (or software vendor) can do any 
processing they want, and 5) mail receivers don't need to accept and 
execute programs from strangers.

One disadvantage has been mentioned: It's harder to set up such a 
service than to add the SPF TXT record.

Arnt

---

From: "Jon Kyme" <[email-masked]>
Date: Thu, 17 Jun 2004 15:50:37 +0100

> of bits and pieces that sound like what we have.

I don't believe that we've discussed anything that hasn't been discussed
publicly here or elsewhere before.

Why don't you make your "white paper" available without registration?