Subject: [domainrep] draft-ietf-repute-email-identifiers leaves role indeterminate

From: Douglas Otis <[email-masked]>
Date: Mon, 21 Nov 2011 15:40:07 -0800

Verbs in these definitions are problematic when referring to DKIM or SPF 
related domains.

DKIM and SPF do not identify actors (even statistically) which leaves 
the term "sending" or "sends" problematic.  In addition, rather than 
using the term "associated with", clarify the relationship to help in 
determining intent.  IANAL, but International Law refutes "Guilt by 
Association" and adopts the principle that guilt is personal and 
established by evidence of acts and their intention. S. Res. 196, 79th 
Cong. 2d Sess.

With SPF, the correct verb is "Authorized".
With DKIM, the correct verb is "Signed".
With IP address, the correct verb is "Transmitted".

SENDS-MALWARE: leaves role(s) played indeterminate.

The prefix AST/AS/AT/T/S/A replaces SENDS where separate acts of 
Authorized, Signed, or Transmitted as a combinatorial prefix.

For example:
AST-MALWARE: Authorized, signed, and transmitted Malware
AST-SPAM: Authorized, signed and transmitted Spam
AST-INVALID-RECIPIENTS: Authorized, signed and transmitted Invalid 
Recipient attempts,

Actual roles should be clarified with specific prefixes such:
A-MALWARE: Authorized Malware
S-MALWARE: Signed Malware
T-MALWARE: Transmitted Malware

-Doug

---

From: Frank Ellermann <[email-masked]>
Date: Tue, 22 Nov 2011 09:59:29 +0100

On 22 November 2011 00:40, Douglas Otis <[email-masked]> wrote:

> the term "sending" or "sends" problematic.

The S in SPF indicates "sender", and the MAIL FROM is also known as
"envelope sender".  That's an actor as far as SMTP is concerned.

> AST-MALWARE: Authorized, signed, and transmitted Malware
[...]

That sounds rather convoluted; A + T is a good approximation of "sent".

-Frank

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 22 Nov 2011 09:44:41 -0800

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Frank Ellermann
> Sent: Tuesday, November 22, 2011 12:59 AM
> To: Douglas Otis
> Cc: domainrep
> Subject: Re: [domainrep] draft-ietf-repute-email-identifiers leaves role indeterminate
> 

I agree, this is a complicated solution.

I'd be fine with changing "SENDS-SPAM" to just "SPAM", defining that to mean "is associated with spam", and the same kind of thing for malware.  The meaning of "is associated with" is then tied back to how the identifier is extracted; for DKIM, it means "handles spam", for example.  The vocabulary document can make this clearer.

---

From: Douglas Otis <[email-masked]>
Date: Tue, 22 Nov 2011 09:45:30 -0800

On 11/22/11 12:59 AM, Frank Ellermann wrote:
> On 22 November 2011 00:40, Douglas Otis<[email-masked]>  wrote:
>
Frank,

This "macro expanded domain policy" (SPF) does not indicate whether other domains share authorized IP addresses.  Sharing is not uncommon.

To allow defending one's reputation, actions must be authenticated against the referenced identities.  Authorizing an IP address extrapolated from indeterminate message elements such as PRA or MAIL FROM will not assure actions (sending) pertain to referenced domains.  Often the intent of SPF is to ensure return of Delivery Status Notifications.  Using SPF as a method to ascertain actions demands changes in how email is normally handled, and is likely to prove harmful in the interim.

> That sounds rather convoluted; A + T is a good approximation of "sent".
While SPF offers Authorization, a matching PRA or MAIL FROM does not 
confirm the referenced domain acted to send the message.  When the 
referenced identity is that of an IP address, the transport weakly 
authenticates this address as the source.  Authenticating the IP address 
or finding that it has been authorized says nothing about which domain 
caused the action.  'T' could be used in conjunction with SPF when EHLO 
in the SMTP exchange confirms the referenced domain.  Even this basis is 
not without risk, as access (not necessarily via SMTP) would permit 
spoofing a domain's messages.

'S' in conjunction with 'A' would be a better approximation of "Sent".  
Unfortunately, this can't be used as a non-disruptive basis for acceptance.

-Doug