[ietf-dkim] what do do with a signature, was detecting
John R. Levine
johnl at iecc.com
Wed Oct 20 08:54:38 PDT 2010
[ I'm following this thread because it's related to advice in 4871 that we
should probably remove from 4871bis ]
>> So you're saying that all a spammer has to do is to put on a throwaway
>> domain's signature, and the MUA will highlight at least parts of the
>> message with green goodness? Surely our understanding of domain
>> reputation is better than that.
> I believe that's the basis of this whole discussion, isn't it. The point is
> that the MUA tells you whether the header was signed, and leaves you to apply
> the domain or address reputation. I think that's a step forward. At least, it
> is when I know the purported author.
Hmmn. You don't know the purported author, all you know is the actual
We have a message offering you a job as an Internet Payment Processor.
It's from recruitment at reliable-home-work.com, and signed by
reliable-home-work.com. Do you paint it green and show it to your users?
What if it was sent through gmail and had a google.com signature? How
many of your users even know what a money mule is?
I think that if you look through papers at CEAS and similar fora, you'll
find that manual classification of mail is not particularly accurate, and
is a huge waste of time. Well tuned filters do at least as good a job
with far less human effort, and the reasonable things for humans to do is
to tell the filtering engine when it guessed wrong either explicitly, or
implicitly by moving stuff between inbox and junk folder.
> And, surely I'm better at assigning reputation to -say- my brother than
> any automated system is.
Given the number of spam complaints I get about on-topic messages to COI
discussion lists, don't count on it. And in any event, unless your
brother is one of us weenies with his own vanity domain, his mail is going
to be signed by his employer or his ISP, so he won't have his own
mailstream reputation anyway.
John Levine, johnl at iecc.com, Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly
More information about the ietf-dkim