Subject: Re: [ietf-dkim] list vs contributor signatures, was Wrong Discussion

From: Ian Eiloart <[email-masked]>
Date: Wed, 02 Jun 2010 12:18:50 +0100

--On 27 May 2010 21:57:54 -0400 "John R. Levine" <[email-masked]> wrote:

>> We have had ADSP deployed since the week before the February MAAWG
>> meeting.  I just asked our infrastructure guru to do a quick check and
>> we are seeing about a million ADSP look-up's per day at this point.
>
> That's a good start.  Now we need to figure out some way to find out
> who's  doing those lookups, and what they're doing with them.
>

It should be fairly easy to figure out how many unique IP addresses are 
doing the lookups, and give some view of the distribution. And then not too 
hard to figure out how many of those IP addresses don't belong to the top 5 
or so mailbox providers.

If paypal want to broaden the uptake of ADSP, then contributing DKIM/ADSP 
code or config recipes to open source MTA projects would be useful!

-- 
Ian Eiloart
IT Services, University of Sussex
01273-873148 x3148
For new support requests, see http://www.sussex.ac.uk/its/help/

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "John R. Levine" <[email-masked]>
Date: 2 Jun 2010 08:35:56 -0400

> It should be fairly easy to figure out how many unique IP addresses are doing 
> the lookups, and give some view of the distribution. And then not too hard to 
> figure out how many of those IP addresses don't belong to the top 5 or so 
> mailbox providers.

That would be of some help, but the real question is what they're doing 
with it after they get it. The top mailbox providers presumably have 
reasonable DNS caches, so their lookups will be imperceptible anyway.

Since few people in the world at large understand DKIM, much less ADSP, 
the large numbers of lookups that Brett reports must be coming from 
software packages that have a configuration that looks them up.  It might 
be possible to intuit from the details of the lookups, e.g., the sequence 
of queries, what packages they are, at which point we could probably look 
and see what they're doing with them.

> code or config recipes to open source MTA projects would be useful!

There's ADSP code in Spamassassin for anyone who wants it.  They suggest 
that you configure it to ignore actual ADSP and hard code a handful of 
domains such as paypal.com and ebay.com.

R's,
John

---

From: Ian Eiloart <[email-masked]>
Date: Wed, 02 Jun 2010 14:37:00 +0100

> domains such as paypal.com and ebay.com.

Why not do both? Look up, and log results for all domains. That'll give you 
evidence to base listing decisions on later. If you do decide to list a 
domain, then take action based on published policy. That gives the 
publisher the ability to change their policy without notifying you out of 
band.