Really, it says feel free to throw our mail away if you have the least
doubt about it.
Is that really what it says? Or is that your personal qualitative
interpretation of something which is not as whimsical as you are
presenting it.
I wrote the language in the ADSP draft, and that is what I meant when I
wrote it.
What that ADSP discardable record published by a sender is saying is
that all email for this domain is signed and if a signature is missing
or fails to validate it is safer (from the receivers perspective) to
discard the email than for it to be delivered to the recipient with the
consequental potential for phishing, trojans, identity theft, etc.
Right. You're better off throwing the message away. It's not worth
reading. See? We agree.
This is like anything else. If people do things they don't understand in
ways that cause bad outcomes, they will either adjust what they are
doing or incur the consequences. For example, if a person publishes a
DKIM record along with ADSP and the public key expires did they really
intend to have mail discarded? Probably not.
Right. That's why I expect to keep a short private list of domains whose
mail actually is all signed and is heavily enough phished that it's better
to discard the unsigned ones, most likely including ag.com, and ignore
ADSP.
Regards,
John Levine, johnl(_at_)taugh(_dot_)com, Taughannock Networks, Trumansburg NY
"I dropped the toothpaste", said Tom, crestfallenly.
_______________________________________________
dkim-ops mailing list
dkim-ops(_at_)mipassoc(_dot_)org
http://mipassoc.org/mailman/listinfo/dkim-ops