From: "Bob Wyman" <bob(_at_)wyman(_dot_)us>
... The
subject discussed was how do you prove that a message was sent by a
specific *server*. The key to simplification here is that the server
will have a DNS record and that DNS record can have SVR records
associated with it. ...
Ok, but why do you care about servers instead of persons? I don't
care how legitimate mail gets into my mailbox. I also don't care how
many signatures are associated with a server that sends spam my way.
It sounds as if you are making the familiar assumption that every
legitimate sender transmits only via a small number of SMTP clients.
That assumption would vastly simplify solving the spam problem, but
it would also vastly change non-technical aspects of the mail system.
From another angle, why is it any harder for a spammer to get a signed,
throw-away domain name than to get a throw-away personal or other
certificate? Some of the ostensibly Chinese spammers are disclosing
several dozen new domain names in my spam traps every day. What
difference would it make if they had signatures to go along with their
domain names?
Yes, most of these spammers seem to be forging sender names (in the
real sense, not in the too familiar bogus sense of "forge"), but I
don't understand why. They could as effectively use their new domain
names as senders including using signatures. I suspect that within
a day or so of the first appearance of their domain names in URLs in
spam, those domain names appear in comemrcial body filters.
Applying Barry Shein's analogy, how does this stop the bad guys
from ringing all of the phones in Manhattan?
Vernon Schryver vjs(_at_)rhyolite(_dot_)com
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg