Douglas Otis wrote:
On 5/3/10 8:58 AM, Alessandro Vesely wrote:
On 02/May/10 13:33, Douglas Otis wrote:
To retain security, the sender's domain needs to assert domain specific
exceptions for "all" or "discard-able" ADSP policies.
That's false, under several acceptations of "security". /Necessity/ of
such assertions only makes sense if "security" is meant to be the
ability of a domain to restrict legitimate uses of its name, such as
its users writing to mailing lists, or to their grandma's.
ADSP "all" or "discardable" with specific third-party authorizations by
a sender's domain does not restrict who may receive their message. This
relates to who is trusted to modify the sender domain's messages.
I agree with the overall concept, but I don't like it stated that
way. In general, recipients may trust third parties independently of
the originating domain.
A naive interpretation of DKIM may consider it has done its job when
the message has been received and verified. But where's the limit?
Besides lists and grandma's broken forwarder, consider ticketing
systems, archiving software, any ad-hoc filter (e.g. scripts
designed for specific transactions, that add their results to the
body of the message itself) and even manual modifications by the
recipients. In all these cases, one obviously doesn't want to alter
the From: for the sole sake of ADSP.
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html