tim wolak wnjqnssktydevcom going wrong address address sktytradingcom relay server resolve correct address happens one user couple people send messages one message internal user sending email thanks original message oigxspoibehdxpsropostfixorg mailtooigxspoibehdxpsropostfixorg behalf ralf hildebrandt sent wednesday february 13 2008 843 rljdsngxyqohpostfixorg subject relay issue tim wolak feb 13 065757 sktymx1 postfixsmtp17149 38c7a3be5d0 relaynone delay59650 statusdeferred connect skytradingcom692514248 connection timed wheres problem connection timed postfix reach skytradingcom relaynone ralf hildebrandt ecfaocnmogiylyncharitede chnnezkhcharitede postfix einrichtung betrieb und wartung tel 49 030450 570155 httpwwwarschkrebsde 2 2 5 extremely large values 2 msqllzeljaedialogcom sun feb 24 103032 2008 message 1 date wed 20 feb 2008 183037 0500 jeff macdonald subject ietfdkim ssp02 problem author signature douglas otis cc dkim list messageid 20080220233037gd15211jmac contenttype textplain charset tue feb 19 2008 030408am 0800 douglas otis wrote expanding upon effect ssp02 author signature definition based upon conversation jim jim suggested comply ssp02 signatures make use irestricted keys really true thought one could use drorg didnt think g instead practice offers explicit token even one opaque identifying useragent introduced message examining header stack guessing header might apply becomes necessary also unknown whether entire header stack captured within signatures hash guessing may also prone introduction spoofed headers attempting resolve top identifiers secondly also means muas attempting highlight signature indicates introduced message also prone getting wrong signatures identity iabsent whenever entity introducing message _not_ represented emailaddresses within header although unlikely domains may feel compelled sign message twice one signature comply ssp02 author signature definition another clarify actually introduced message think able use multiple signatures offers flexibility result instead dkim offering reportable displayable identifier clarifying introduced message identifier must guessed dont think really matters introduced message really matters dkim identities recognizable jims example definition needed offers yet another problem scheme recommendation 1 change author signature author domain signature 2 change author signing policy author domain signing policy 3 accept premise author domain signs message message complaint author domains signing policy _by definition_ 4 message signed author domain author domain signing policy need checking seem reasonable dont know need fine grained jeff macdonald director messaging technologies edialog msqllzeljaedialogcom 131 hartwell ave lexington 02421 v 7813721922 f 7818638118 wwwedialogcom lhmncommunigatecom sun feb 24 103032 2008 message 2 date wed 20 feb 2008 164357 0800 thom oconnor subject ietfdkim draftietfdkimssp02txt discardableexclusive gfkyhddlmipassocorg messageid 47bcc94d7030200communigatecom contenttype textplain charset eric allman wrote way married word discardable used ssp02 matched asp occurred weve spent far much time arguing exactly word use im deeply tempted switch numbers special characters random gibberish strings people read actual description hi eric understand sentiment point notable however important terminology use accurate appropriate global messaging userbase wants expects guidance implementation clear direct truth matter discarding email expressly discouraged message ever discarded rfc 2821 suggests though explicitly disallow discourage httpwwwietforgrfcrfc2821txt delivery smtp systems may reject bounce messages rather deliver discarding email one key causes significant loss trust email reliable means communication may argued spam may caused email receiving domains react way defense mechanism actually overreaction perhaps due lack guidance allowed providers think discarding messages satisfactory response spam malware threat perhaps techniques 100 accurate ensuring valid message ever lost discarding could appropriate techniques likely ever reach 100 accuracy email industry seeks maintain even expand usefulness email rather seeing users resort making phone call using im need sure method communication clear one appropriate value ssp record would reject something equally directive perhaps verify really seek clear signing practice use perhaps may even include none value none domain signs email unknown domain may sign none email mail domain signed author signature reject verify mail domain signed author signature furthermore message arrives without valid author signature due modification transit submission via path without access signing key reason domain encourages recipients reject verify certainly valid reasons domain may request higher level requested interpretation signaturebased verification moves email towards optional higher level reliability identity verification legal commercial implications douglas otis wrote agreed changes strict exclusivity assertion something express domains intentions exclusivity assertion simply increases likelihood domains messages discarded using hectors term exclusive exclusive mail domain signed intent avoid agents may damage remove signatures furthermore lieu trusted thirdparty signature message arrives without valid author signature due modification transit submission via path without access signing key reason domain encourages recipients reject message issue dsn rfc 2821 mailfrom domains match line thinking target though really need get better using words users understand exclusive ambiguous would argue easily understood concept signature verify would seem error message could possibly understood normal user dsn message sincerely respectfully thom dyrbcmciscocom sun feb 24 103032 2008 message 3 date wed 20 feb 2008 215509 0800 jim fenton subject ietfdkim ssp02 problem author signature jeff macdonald cc dkim list messageid 47bd123d3040206ciscocom contenttype textplain charset jeff macdonald wrote tue feb 19 2008 030408am 0800 douglas otis wrote expanding upon effect ssp02 author signature definition based upon conversation jim jim suggested comply ssp02 signatures make use restricted keys really true thought one could use drorg didnt think g misunderstood local part ikey restricted use gbe used times things well point example gave isignature author address message something like jdoefoobarorg instead practice offers explicit token even one opaque identifying useragent introduced message examining header stack guessing header might apply becomes necessary also unknown whether entire header stack captured within signatures hash guessing may also prone introduction spoofed headers attempting resolve top identifiers secondly also means muas attempting highlight signature indicates introduced message also prone getting wrong signatures identity absent whenever entity introducing message _not_ represented emailaddresses within header huh asp prohibit signatures provides additional information although unlikely domains may feel compelled sign message twice one signature comply ssp02 author signature definition another clarify actually introduced message think able use multiple signatures offers flexibility sure doesnt signing sender header field clarify actually introduced message thats important result instead dkim offering reportable displayable identifier clarifying introduced message identifier must guessed dont think really matters introduced message really matters dkim identities recognizable yes thats point jims example definition needed offers yet another problem scheme recommendation 1 change author signature author domain signature 2 change author signing policy author domain signing policy 3 accept premise author domain signs message message complaint author domains signing policy _by definition_ 4 message signed author domain author domain signing policy need checking seem reasonable dont know need fine grained signing policy expressed domain level doesnt mean definition author signature must also exactly level granularity author domain signing policy still deal author signatures jim vhwiohowbcoxcom sun feb 24 103032 2008 message 4 date wed 20 feb 2008 231738 0500 subject ietfdkim draftietfdkimssp02txt discardableexclusive messageid contenttype textplain charset strange wonder explains 2k bounce messages undeliverability due content honey trap mail account spoofed last 3 days alone appears cheap software designer shoes line degrees dont apply rfcs seems organizations around world dont adhere specs commercial messages need delivered inbox method edge edge smtp via community service bureau entity would allow 99999 delivery rate valid messages killing 99999 spam also would free considerable bandwith commercial mail would need one copy message delivered isp instead spraying millions hoping high receive rate thanks bill original message lrbigfuhnacdbbdmipassocorg behalf thom oconnor sent wed 2202008 743 pm gfkyhddlmipassocorg subject ietfdkim draftietfdkimssp02txt discardableexclusive eric allman wrote way married word discardable used ssp02 matched asp occurred weve spent far much time arguing exactly word use im deeply tempted switch numbers special characters random gibberish strings people read actual description hi eric understand sentiment point notable however important terminology use accurate appropriate global messaging userbase wants expects guidance implementation clear direct truth matter discarding email expressly discouraged message ever discarded rfc 2821 suggests though explicitly disallow discourage httpwwwietforgrfcrfc2821txt delivery smtp systems may reject bounce messages rather deliver discarding email one key causes significant loss trust email reliable means communication may argued spam may caused email receiving domains react way defense mechanism actually overreaction perhaps due lack guidance allowed providers think discarding messages satisfactory response spam malware threat perhaps techniques 100 accurate ensuring valid message ever lost discarding could appropriate techniques likely ever reach 100 accuracy email industry seeks maintain even expand usefulness email rather seeing users resort making phone call using im need sure method communication clear one appropriate value ssp record would reject something equally directive perhaps verify really seek clear signing practice use perhaps may even include none value none domain signs email unknown domain may sign none email mail domain signed author signature reject verify mail domain signed author signature furthermore message arrives without valid author signature due modification transit submission via path without access signing key reason domain encourages recipients reject verify certainly valid reasons domain may request higher level requested interpretation signaturebased verification moves email towards optional higher level reliability identity verification legal commercial implications douglas otis wrote agreed changes strict exclusivity assertion something express domains intentions exclusivity assertion simply increases likelihood domains messages discarded using hectors term exclusive exclusive mail domain signed intent avoid agents may damage remove signatures furthermore lieu trusted thirdparty signature message arrives without valid author signature due modification transit submission via path without access signing key reason domain encourages recipients reject message issue dsn rfc 2821 mailfrom domains match line thinking target though really need get better using words users understand exclusive ambiguous would argue easily understood concept signature verify would seem error message could possibly understood normal user dsn message sincerely respectfully thom _______________________________________________ note well list operates according httpmipassocorgdkimietflistruleshtml wyzclerewmanacuk sun feb 24 103032 2008 message 5 date thu 21 feb 2008 120135 0000 charles lindsey subject ietfdkim spam3 new issue ssp02 policy scope dkim messageid contenttype textplain formatd delsp wed 20 feb 2008 183053 0000 douglas otis wrote feb 20 2008 341 charles lindsey wrote fri 15 feb 2008 192729 0000 douglas otis abuseorg wrote feb 15 2008 450 charles lindsey wrote thu 14 feb 2008 190841 0000 douglas otis wrote colon default must concern regarding defaults addressed take 3 version includes means exclude policy indeed take 3 starts seems point accepted matches unlisted transport protocols disavows protocol use excludes protocol policy assertions suspect default whatsoever used contradicting first say default saying suspect default policy assertion might affected publisher expect rather potentially blocking protocols assertion default would require publishers proactively make explicit restrictions protocols comments list seems view policy record related messages entering smtp related infrastructure respect smtp policy would applied anyway policy record impact fully independent separate message transports seems though explicit explicit policy also allow verifier better trust restriction intent policy trust assertion important waffle still answered question proposing default ss publishers ssp records stricter policy declare careful must users domain able bypass signing mechanism using strange protocolswhatever problem publish sthe default saying anything arrives looking like rfc 2822 message dopmain unsigned rejectdiscardsuspectwhatever publish suucpnntpwhateverelse syaing ok signed gets gatewayed back smtp verifiers may able tell smtp originally still rejectdiscardsuspectwhatever intend sprotocol received verifier still rejectedwhatever even though legitimately left original domain unsigned via uucpnntp gateway supposed gatewayed situation created glorious opportunity everyone blame everyone else preventing mail delivered short thing work face gatewaying sort say ssp applies anything looking like rfc 2822 object case dont need type transport always implied messages handled primarily smtp transport would absolutely right smtp assumption made dkim also used independent separate message transports protocols completely unrelated smtp case transport also implied would smtp supposed mean charleshlindseyathomedoingmyownthing tel441614366131 webhttpwwwcsmanacukchl emailwyzclerewmanacuksnail5clerewoodavecheadlesk83juuk pgp2c15f1a9fingerprint736dc25193a001e765e8647e14a4aba5 _______________________________________________ note well list operates according end ietfdkim digest vol 108 issue 4 tue 05 aug 2008 221824 0600 relay issue