I got the impression from the original that he was not doing that, and
looking up the _whole_ Message-ID.
yes
There's no easy transition either - you'd never know if whom you were
doing these queries actually implemented this stuff, and NXDOMAIN could
mean either "BAD! BAD! discard!" or "I don't implement that feature".
same as SPF and DKIM. They are more or less good if all implement them !
It's trying to make "SPF -all" survive forwarding, but not as well as
DKIM would (absent message mangulation).
DKIM is good for forwarding but it does not solve phishing !
He's suggesting asking _both_ A and B. So both paypal.com and
example.com would have to say "Yup, I know that Message-ID".
yes, that is the idea. Already answered in previous mail
So, you'd have to control example.com and have one (presumably recent)
sample Message-ID from paypal.com, and you could send as many as you
want with any contents you want.
[Few (if any) MTAs enforce unique Message-IDs on inbound email.]
well...a good point to investigate
Neither SPF or DKIM are perfect, but it behooves us to not try to
bandaid their defects with something like this. Patching a hole in a
submarine with window screening comes to mind as a suitable analogy ;-)
ok, not bandaid.....let´s reinvent SMTP with 3 way handshake ! that is
a more suitable analogy for my idea !
_______________________________________________
Asrg mailing list
Asrg(_at_)irtf(_dot_)org
http://www.irtf.org/mailman/listinfo/asrg