Subject: AOL on Sender I.D..

From: "Anne P. Mitchell, Esq." <[email-masked]>
Date: Wed, 15 Sep 2004 21:54:39 -0700

I gather this is a "no" vote?:

"AOL Dumps Sender ID"

http://www.internetnews.com/xSP/article.php/3408601

" AOL (Quote, Chart) has withdrawn its support for Microsoft's 
controversial Sender ID technology and is falling back on Sender Policy 
Framework (SPF), internetnews.com has learned.

  "Given recent concerns expressed by the Internet Engineering Task 
Force (IETF), coupled with the tepid support for Sender ID in the open 
source community, AOL has decided to move forward with SPF," Nicholas 
Graham, AOL spokesperson, told internetnews.com via e-mail.

  Microsoft was not available for comment at press time.

  Despite the bombshell decision, the world's top ISP isn't completely 
severing its ties to Sender ID: The company still will publish Sender 
ID files so its users' e-mails are compliant with Sender ID-enabled 
servers and applications. But it's enough of a vote of no confidence in 
Microsoft's e-mail authentication strategy to warrant concern for 
Sender ID proponents."

Full story at link above.

Anne

---

From: Andrew Newton <[email-masked]>
Date: Thu, 16 Sep 2004 12:22:57 -0400

Before discussion goes much further on this topic, we ask the working 
group not to give press releases and news articles much elaboration.  
This is not because their content is unimportant, but because this is a 
discussion list and it is hard to conduct a discussion with a press 
release.

We do welcome any statements directly from AOL or any network 
operations group regarding their plans for Sender ID or CSV.  However, 
we ask that they respect the fact that this is a discussion list and be 
prepared to answer any technical questions that may arise from their 
statements.

-andy, MARID co-chair

---

From: Carl Hutzler <[email-masked]>
Date: Thu, 16 Sep 2004 15:34:20 -0400

> prepared to answer any technical questions that may arise from their

We remain committed to sender identity technologies.

We intend to begin beta testing SPF on our inbound systems very soon (weeks
from now). SPF is low hanging fruit that will benefit AOL and many other
domains although it will not work for 100% of the mail we receive. But it
will work for >80% of the mail we receive and that is good enough for a
first strike.

We also believe that the best way to secure the 822 FROM address is a
content signing approach which is out of the scope of this working group. We
hope to see a new group formed to tackle the issues in this arena.
DomainKeys, IIM and TEOS are all reasonable technologies in this arena. We
are sure their will be more which is a good thing for a working group :-)

We remain committed to other IP based approaches and see a lot of benefit to
the "newer" CSV idea. AOL already gets >85% of our spam from other ISPs main
outbound MTAs. SPF, SenderID, and Domainkeys will not change that as this
mail also uses the legit domain of that local ISP in the 821/822 headers.
CSV and certain best practice documents (BCPs) shift the responsibility to
the sending organization for the mess they create through their insecure
networks and insecure practices (like lack of SMTP AUTH of any form, lack of
any outbound controls, inability to suspend accounts, insecure web servers,
etc).

-Carl

-- 
Carl Hutzler
Director, AntiSpam Operations
America Online Mail Operations
[email-masked]
703.265.5521 work
703.915.6862 cell