Subject: [ietf-dkim] draft-otis-dkim-tpa-label-05 update

From: Douglas Otis <[email-masked]>
Date: Sun, 27 Jun 2010 13:22:55 -0700

The file can be viewed at:

http://datatracker.ietf.org/doc/draft-otis-dkim-tpa-label/

A comparison of the changes between version 4 to 5 is at:

http://www.sonic.net/~dougotis/dkim/draft-otis-dkim-tpa-label-04-to-05.html

Many of the changes corrected grammatical errors, dumb mistakes, some 
overly complex sentences.

The only headers the authorization might require, beyond the From header 
of course, is List-ID and Sender.  Since a major motivation for using 
ADSP is as a defense against phishing, the PRA header was not included.  
The use of PRA as a basis for acceptance will not mitigate spoofing of 
the From header, since domains change too rapidly.

This version:

- Compares simple name concatenation with the use of TPA-Labels.

- Includes a description for 'H' and 'M' scopes compliance checks. (This 
is intended to offer an interim solution for third-party services not 
yet using DKIM.)

- Adds an expectation for MX records for ADSP subdomains.

For those wanting except-mlist, a bare "tpa-sig" offers that mode, 
without ignoring authentication and authorization in the process. 
Depending upon the use of authentication becomes easier when general 
purpose TPA lists are made available.  A "dkim=all tpa-sig" defines a 
clear state for when messages are to be refused.

While ADSP might not be suitable for every From domain, it can be 
suitable for most DKIM signing domains.

This draft hopes to provide an alternative to a bad practice of using 
subdomains with reduced protections when dealing with thrid-domain 
services.  For domains already being phished, such a practice will 
simply lead to there being more victims.

Thanks for the feedback. If I missed acknowledging anyone, send me a 
note privately.

-Doug
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html