[ietf-dkim] Delegating responsibility: a make vs. buy design
dotis at mail-abuse.org
Mon Aug 21 11:39:27 PDT 2006
On Aug 21, 2006, at 10:56 AM, Wietse Venema wrote:
> Dave Crocker:
>> For the case of mail that is signed, I am still waiting to hear
>> why it is not sufficient to have a third-party use a a sub-domain
>> of the referred (author, or whatever) domain name.
> For example, domain example.com stores their dedicated public key
> under a dedicated domain something.example.com.
> Even when the signing operation itself is outsourced to a third
> party, using a dedicated signing key+domain for user at example.com
> gives better protection than a scenario where the same shared,
> unrelated, key+domain signs mail from thousands of different domains.
Not necessarily. This would still trust the provider to restrict
permissions for the arranged domain by the account accessing the
outbound MTA. If the provider always ensured the 2822.From had been
validated per account, then use of a common domain still retains
protection for the 2822.From address.
> With a shared signing key+domain, if one of those thousands of
> domains mis-behaves, all the other domains could suffer from the
> bad reputation of that shared signing key+domain.
Some abuse is normally allowed of any source, especially large
domains serving millions of users. Due to replay issues, a DKIM
signature alone may not offer effective acceptance criteria. Sharing
the services of such a domain could be relatively safe, and provide a
means for the 2822.From to be annotated as valid without needing to
make key/domain arrangements, provided the provider includes a
mechanism that limits accounts to only validated 2822.From addresses.
> Thus it's better to avoid shared signing key+domain scenarios.
This would really depend upon how well the signing domain was managed.
>> Hence, the signing practices requirement would only exist for
>> unsigned messages.
> Indeed. With a dedicated signing key+domain as discussed above, the
> rfc822.from is protected by a first-party signature only.
Not necessarily. There still must be a restriction placed on the
2822.From address per account somewhere in the path of the message.
> All other signatures are by definition third-party, and vouch for
> the signer, not the rfc822.from.
Not necessarily. It is possible to validate the 2822.From address
outside the signing domain. Such domains that first validate all
2822.From addresses can be considered equivalent to a 1st party domain.
> Signing practices can tell us if mail without first-party signature
> is a possible forgery, regardless of whether or not that mail has a
> third-party signature.
It can also indicate whether the 2822.From should be considered
valid. Although policy can indicate which domains are expected to
sign for the 2822.From, without an ability to discern whether the
2822.From address is valid, there would be little benefit obtained
going to the effort of checking the policy.
More information about the ietf-dkim